From 3502923088d17737e0e174d130dce87b68030d6f Mon Sep 17 00:00:00 2001 From: Alon Karmona Date: Tue, 20 Oct 2026 14:56:17 +0300 Subject: [PATCH] Migrate Snowflake (3.2.2) to Defender XDR Custom Detections (V3.1) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9f05623b-293a-427c-a28f-23d9b3fcc32c --- .../SnowflakeDiscoveryActivity.yaml | 1128 +++++++- .../SnowflakeLongQueryProcessTime.yaml | 1122 +++++++- .../SnowflakeMultipleFailedQueries.yaml | 1130 +++++++- .../SnowflakeMultipleLoginFailure.yaml | 1126 +++++++- .../SnowflakeMultipleLoginFailureFromIP.yaml | 1126 +++++++- .../SnowflakePossibleDataDestruction.yaml | 1126 +++++++- .../SnowflakePrivilegesDiscovery.yaml | 1122 +++++++- .../SnowflakeQueryOnSensitiveTable.yaml | 1127 +++++++- .../Analytic Rules/SnowflakeUnusualQuery.yaml | 1124 +++++++- .../SnowflakeUserAddAdminPrivileges.yaml | 1131 +++++++- .../Snowflake/Data/Solution_Snowflake.json | 17 +- Solutions/Snowflake/Package/3.2.2.zip | Bin 0 -> 428681 bytes .../Snowflake/Package/createUiDefinition.json | 58 +- Solutions/Snowflake/Package/mainTemplate.json | 2490 ++++++++++++++++- .../Snowflake/Package/testParameters.json | 42 + Solutions/Snowflake/ReleaseNotes.md | 1 + Solutions/Snowflake/SolutionMetadata.json | 34 +- .../SnowflakeDiscoveryActivity.yaml | 1905 +++++++++++++ .../SnowflakeLongQueryProcessTime.yaml | 1901 +++++++++++++ .../SnowflakeMultipleFailedQueries.yaml | 1907 +++++++++++++ .../SnowflakeMultipleLoginFailure.yaml | 1905 +++++++++++++ .../SnowflakeMultipleLoginFailureFromIP.yaml | 1886 +++++++++++++ .../SnowflakePossibleDataDestruction.yaml | 1905 +++++++++++++ .../SnowflakePrivilegesDiscovery.yaml | 1901 +++++++++++++ .../SnowflakeQueryOnSensitiveTable.yaml | 1904 +++++++++++++ .../XDR Detections/SnowflakeUnusualQuery.yaml | 1902 +++++++++++++ .../SnowflakeUserAddAdminPrivileges.yaml | 1905 +++++++++++++ 27 files changed, 32585 insertions(+), 340 deletions(-) create mode 100644 Solutions/Snowflake/Package/3.2.2.zip create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakeDiscoveryActivity.yaml create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakeLongQueryProcessTime.yaml create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakeMultipleFailedQueries.yaml create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailure.yaml create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailureFromIP.yaml create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakePossibleDataDestruction.yaml create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakePrivilegesDiscovery.yaml create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakeQueryOnSensitiveTable.yaml create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakeUnusualQuery.yaml create mode 100644 Solutions/Snowflake/XDR Detections/SnowflakeUserAddAdminPrivileges.yaml diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeDiscoveryActivity.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeDiscoveryActivity.yaml index aef337782f0..f5f0cef91a2 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeDiscoveryActivity.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeDiscoveryActivity.yaml @@ -1,33 +1,1119 @@ id: 09b8dfc7-87b0-4215-b34b-bab363d685cb name: Snowflake - Possible discovery activity -description: | - 'Detects possible discovery activity.' +description: '''Detects possible discovery activity.'' + + ' severity: Medium -status : Available +status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Discovery +- Discovery relevantTechniques: - - T1526 -query: | - let threshold = 20; - Snowflake - | where QueryType =~ 'SHOW' - | where QueryExecutionStatus =~ 'SUCCESS' - | summarize count() by TargetUsername, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend AccountCustomEntity = TargetUsername +- T1526 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 20;\nSnowflake\n| where QueryType =~ 'SHOW'\n| where\ + \ QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated,\ + \ 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.2 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeLongQueryProcessTime.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeLongQueryProcessTime.yaml index 1edc2437638..4667829fd3b 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeLongQueryProcessTime.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeLongQueryProcessTime.yaml @@ -1,30 +1,1118 @@ id: 1376f5e5-855a-4f88-8591-19eba4575a0f name: Snowflake - Abnormal query process time -description: | - 'Detects query with abnormal proccess time.' +description: '''Detects query with abnormal proccess time.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Impact +- Impact relevantTechniques: - - T1499 -query: | - let threshold = 10000; - Snowflake - | where QueryTotalElapsedTime > threshold - | extend AccountCustomEntity = TargetUsername +- T1499 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 10000;\nSnowflake\n| where QueryTotalElapsedTime\ + \ > threshold\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml index 7c9c058bb49..3e008bdfdf1 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleFailedQueries.yaml @@ -1,35 +1,1121 @@ id: 5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8 name: Snowflake - Multiple failed queries -description: | - 'Detects multiple failed queries in short timeframe.' +description: '''Detects multiple failed queries in short timeframe.'' + + ' severity: High status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Discovery +- Discovery relevantTechniques: - - T1518 - - T1082 -query: | - let threshold = 50; - Snowflake - | where isnotempty(QueryExecutionStatus) - | where QueryExecutionStatus !~ 'SUCCESS' - | summarize count() by TargetUsername, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend AccountCustomEntity = TargetUsername +- T1518 +- T1082 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 50;\nSnowflake\n| where isnotempty(QueryExecutionStatus)\n\ + | where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername,\ + \ bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity\ + \ = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.3 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled - diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailure.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailure.yaml index 549eb4bbe23..4e5fa07bbd3 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailure.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailure.yaml @@ -1,33 +1,1119 @@ id: e05cc333-d499-430f-907c-7f28a9e4d1b5 name: Snowflake - Multiple login failures by user -description: | - 'Detects multiple login failures by user.' +description: '''Detects multiple login failures by user.'' + + ' severity: High status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - InitialAccess +- InitialAccess relevantTechniques: - - T1078 -query: | - let threshold = 10; - Snowflake - | where EventType =~ 'LOGIN' - | where LoginIsSuccess =~ 'No' - | summarize count() by TargetUsername, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend AccountCustomEntity = TargetUsername +- T1078 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where\ + \ LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated,\ + \ 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.2 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml index 44f3164d5f6..125185f4ee5 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml @@ -1,33 +1,1119 @@ id: b7d22407-1391-4256-b09a-414a9719443c name: Snowflake - Multiple login failures from single IP -description: | - 'Detects Mmltiple login failures from single IP.' +description: '''Detects Mmltiple login failures from single IP.'' + + ' severity: High status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - InitialAccess +- InitialAccess relevantTechniques: - - T1078 -query: | - let threshold = 10; - Snowflake - | where EventType =~ 'LOGIN' - | where LoginIsSuccess =~ 'No' - | summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend IPCustomEntity = SrcDvcIpAddr +- T1078 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where\ + \ LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated,\ + \ 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr\n" entityMappings: - - entityType: IP - fieldMappings: - - identifier: Address - columnName: IPCustomEntity -version: 1.0.2 +- entityType: IP + fieldMappings: + - identifier: Address + columnName: IPCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakePossibleDataDestruction.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakePossibleDataDestruction.yaml index 3066f06ab21..b15bfc5d94e 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakePossibleDataDestruction.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakePossibleDataDestruction.yaml @@ -1,33 +1,1119 @@ id: c2f93727-e4b0-4cb9-8f80-f52ebbd96ece name: Snowflake - Possible data destraction -description: | - 'Detects possible data destruction.' +description: '''Detects possible data destruction.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Impact +- Impact relevantTechniques: - - T1485 -query: | - let threshold = 10; - Snowflake - | where QueryType =~ 'DROP' - | where QueryExecutionStatus =~ 'SUCCESS' - | summarize count() by TargetUsername, bin(TimeGenerated, 5m) - | where count_ > threshold - | extend AccountCustomEntity = TargetUsername +- T1485 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet threshold = 10;\nSnowflake\n| where QueryType =~ 'DROP'\n| where\ + \ QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated,\ + \ 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakePrivilegesDiscovery.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakePrivilegesDiscovery.yaml index 6bba84b6e0f..87831c135b8 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakePrivilegesDiscovery.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakePrivilegesDiscovery.yaml @@ -1,30 +1,1118 @@ id: 627a4ff1-036b-4375-a9f9-288d5e1d7d37 name: Snowflake - Possible privileges discovery activity -description: | - 'Detects possible privileges discovery activity.' +description: '''Detects possible privileges discovery activity.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Discovery +- Discovery relevantTechniques: - - T1087 -query: | - Snowflake - | where QueryType =~ 'SHOW' - | where QueryText has_all ('SHOW', 'ROLES') - | extend AccountCustomEntity = TargetUsername +- T1087 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nSnowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all\ + \ ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml index 1027b166b15..89ac01afe4b 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml @@ -1,33 +1,1120 @@ id: f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e name: Snowflake - Query on sensitive or restricted table -description: | - 'Detects query on sensitive or restricted table.' +description: '''Detects query on sensitive or restricted table.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Collection +- Collection relevantTechniques: - - T1119 -query: | - let r_tbl = dynamic(['table_name']); - Snowflake - | where QueryType =~ 'SELECT' - | where QueryExecutionStatus =~ 'SUCCESS' - | extend tbl = extract(@'(FROM|from)\s(\S+)\s', 2, QueryText) - | where tbl in~ (r_tbl) - | extend AccountCustomEntity = TargetUsername +- T1119 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet r_tbl = dynamic(['table_name']);\nSnowflake\n| where QueryType\ + \ =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\\ + s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity\ + \ = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeUnusualQuery.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeUnusualQuery.yaml index 0b78b917949..30a15a04592 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeUnusualQuery.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeUnusualQuery.yaml @@ -1,31 +1,1119 @@ id: 1dd1d9e5-3ebf-43cb-be07-6082d5eabe79 name: Snowflake - Unusual query -description: | - 'Detects unusual query.' +description: '''Detects unusual query.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - Collection +- Collection relevantTechniques: - - T1119 -query: | - Snowflake - | where QueryType =~ 'SELECT' - | where QueryExecutionStatus =~ 'SUCCESS' - | where QueryText startswith @'SELECT *' - | extend AccountCustomEntity = TargetUsername +- T1119 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nSnowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus\ + \ =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity\ + \ = TargetUsername\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 kind: Scheduled diff --git a/Solutions/Snowflake/Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml b/Solutions/Snowflake/Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml index ca5c3efbc3a..02e0a55c4dd 100755 --- a/Solutions/Snowflake/Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml +++ b/Solutions/Snowflake/Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml @@ -1,34 +1,1121 @@ id: 5ed33eee-0ab6-4bf5-9e9b-6100db83d39a name: Snowflake - User granted admin privileges -description: | - 'Detects when user asigned admin privileges.' +description: '''Detects when user asigned admin privileges.'' + + ' severity: Medium status: Available requiredDataConnectors: - - connectorId: Snowflake - dataTypes: - - Snowflake +- connectorId: Snowflake + dataTypes: + - Snowflake queryFrequency: 1h queryPeriod: 1h triggerOperator: gt triggerThreshold: 0 tactics: - - PrivilegeEscalation +- PrivilegeEscalation relevantTechniques: - - T1078 -query: | - let adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']); - Snowflake - | where QueryType =~ 'GRANT' - | where QueryText startswith 'GRANT ROLE' - | extend granted_role = extract(@'GRANT ROLE\s(\S+)\sto\suser', 1, QueryText) - | where granted_role in~ (adm_roles) - | extend usr = extract(@'GRANT ROLE\s(\S+)\sto\suser(\S+)', 2, QueryText) - | extend AccountCustomEntity = usr +- T1078 +query: "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType\ + \ = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s',\ + \ ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType =\ + \ column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s',\ + \ ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n\ + \ QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n\ + \ LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n\ + \ QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n \ + \ RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n\ + \ EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n\ + };\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n\ + \ | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId\ + \ = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection\ + \ = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n \ + \ LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time,\ + \ 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n\ + \ LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\"\ + , JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n\ + \ LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n \ + \ LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n\ + \ LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n\ + \ LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\"\ + , JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n\ + \ | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\n\ + SnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"\ + $.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy\ + \ = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view\ + \ = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime =\ + \ extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime\ + \ = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n\ + \ MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime,\ + \ 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\"\ + , JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n\ + \ MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName\ + \ = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view =\ + \ view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n\ + \ CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"\ + $.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\"\ + , JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime,\ + \ 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime,\ + \ 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment\ + \ = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\"\ + , JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName\ + \ = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"\ + $.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\"\ + , JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"\ + $.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n\ + \ DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn\ + \ = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n\ + \ RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime,\ + \ 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n\ + \ RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName\ + \ = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"\ + $.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\"\ + , JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n\ + \ RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption\ + \ = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"\ + $.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType\ + \ = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance\ + \ = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view =\ + \ view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend\ + \ EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand\ + \ innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\ + \ LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId\ + \ = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"\ + $.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n\ + \ LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId\ + \ = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"\ + $.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\",\ + \ JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime,\ + \ 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"\ + $.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\"\ + , JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\"\ + , JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\"\ + , JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\"\ + , JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n\ + \ LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view\ + \ = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n\ + \ | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n\ + \ | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime\ + \ = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\"\ + , JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n \ + \ SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"\ + $.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\"\ + , JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n\ + \ TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n\ + \ TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n\ + \ TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n\ + \ TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n\ + \ TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n\ + \ TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n\ + \ TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n\ + \ TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n\ + \ TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n\ + \ TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n\ + \ TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\"\ + , JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n\ + \ TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime,\ + \ 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe\ + \ = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime,\ + \ 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime,\ + \ 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated\ + \ = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n\ + \ TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) -\ + \ tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"\ + $.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\"\ + , JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n\ + \ | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"\ + $.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n\ + \ LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"\ + $.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\",\ + \ JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n \ + \ TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema\ + \ = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"\ + $.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\"\ + , JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n \ + \ TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient\ + \ = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"\ + $.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\"\ + , JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n\ + \ TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount\ + \ = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\"\ + , JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n\ + \ TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\"\ + , JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\"\ + , JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\"\ + , JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\"\ + , JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\"\ + , JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\"\ + , JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n \ + \ TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated\ + \ = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n\ + \ TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime,\ + \ 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime,\ + \ 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n\ + \ TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime,\ + \ 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\"\ + , JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n \ + \ TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId\ + \ = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view\ + \ () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct\ + \ = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray\ + \ = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime\ + \ = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\"\ + , JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n\ + \ LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"\ + $.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\",\ + \ JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n\ + \ | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName\ + \ = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime,\ + \ 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime,\ + \ 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"\ + $.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\"\ + , JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n\ + \ UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"\ + $.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\"\ + , JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n\ + \ UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"\ + $.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\"\ + , JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\",\ + \ JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\",\ + \ JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n\ + \ UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid\ + \ = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"\ + $.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime,\ + \ 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime,\ + \ 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime,\ + \ 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime,\ + \ 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"\ + $.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime,\ + \ 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"\ + $.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\"\ + , JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName\ + \ = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"\ + $.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\"\ + , JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\n\ + let SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray\ + \ = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString\ + \ = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\"\ + , JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime\ + \ = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime\ + \ = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime\ + \ = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n\ + \ QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime,\ + \ 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n\ + \ QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId\ + \ = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"\ + $.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\"\ + , JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n\ + \ QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId\ + \ = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"\ + $.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n\ + \ QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName\ + \ = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"\ + $.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\"\ + , JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n\ + \ QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"\ + $.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"\ + $.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"\ + $.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"\ + $.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"\ + $.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"\ + $.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\"\ + , JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n\ + \ QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded\ + \ = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"\ + $.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"\ + $.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"\ + $.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"\ + $.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"\ + $.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud =\ + \ extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes\ + \ = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes\ + \ = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned\ + \ = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal\ + \ = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage\ + \ = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork\ + \ = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime\ + \ = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus =\ + \ extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"\ + $.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\"\ + , JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\"\ + , JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\"\ + , JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n\ + \ QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\"\ + , JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\"\ + , JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\"\ + , JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\"\ + , JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\"\ + , JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\"\ + , JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\"\ + , JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\"\ + , JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n\ + \ QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n \ + \ ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n\ + \ QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash =\ + \ extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\"\ + , JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\"\ + , JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\"\ + , JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\"\ + , JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\"\ + , JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n\ + \ QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime\ + \ = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"\ + $.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\"\ + , JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n\ + \ QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName\ + \ = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view\ + \ = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n |\ + \ extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n\ + \ LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType\ + \ = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp\ + \ = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n\ + \ LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor\ + \ = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n\ + \ LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n\ + \ LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n\ + \ LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n\ + \ LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId\ + \ = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName\ + \ = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n \ + \ SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime\ + \ = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n\ + \ UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n\ + \ UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view\ + \ = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n\ + \ | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n\ + \ | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n\ + \ MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed\ + \ = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n\ + \ MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId\ + \ = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n\ + \ MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName\ + \ = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n\ + \ DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n\ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n\ + \ RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n\ + \ RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n\ + \ OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n\ + \ MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n\ + \ RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n\ + \ RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n\ + \ RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema =\ + \ tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName\ + \ = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n\ + \ RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance\ + \ = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n\ + \ | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n\ + \ LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n\ + \ LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n\ + \ LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n\ + \ LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n\ + \ LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n\ + \ LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition\ + \ = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n\ + \ LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n\ + };\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n\ + \ TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime\ + \ = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n\ + \ CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n\ + \ TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId\ + \ = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n\ + \ TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog\ + \ = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n\ + \ TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes\ + \ = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n\ + \ TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes\ + \ = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n\ + \ TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n \ + \ TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId\ + \ = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n\ + \ LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime\ + \ = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n \ + \ TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n\ + \ TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n\ + \ TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n\ + \ TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n\ + \ TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n\ + \ TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n\ + \ TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n\ + \ TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName\ + \ = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n\ + \ TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema\ + \ = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n\ + \ TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n\ + \ TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType\ + \ = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n \ + \ TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes\ + \ = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n\ + \ TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging\ + \ = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n\ + \ DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime\ + \ = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n\ + \ PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n\ + \ UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n\ + \ UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n\ + \ UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n\ + \ UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n\ + \ UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n\ + \ UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n\ + \ UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n\ + \ UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n\ + \ UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n\ + \ UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n\ + \ UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n\ + \ UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n\ + \ UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n\ + \ UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy\ + \ = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n\ + };\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList =\ + \ todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime =\ + \ toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n \ + \ QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n\ + \ QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId\ + \ = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId\ + \ = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n \ + \ QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n\ + \ QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n\ + \ QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n\ + \ QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n\ + \ QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n\ + \ QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n\ + \ QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n\ + \ QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n\ + \ QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache\ + \ = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n \ + \ QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult\ + \ = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n \ + \ QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n\ + \ QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n\ + \ QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n\ + \ QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage\ + \ = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n\ + \ QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime\ + \ = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n\ + \ QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime\ + \ = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n\ + \ QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion\ + \ = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n\ + \ QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion\ + \ = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n\ + \ QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices\ + \ = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n \ + \ QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations\ + \ = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes\ + \ = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n\ + \ QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement\ + \ = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n\ + \ QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor\ + \ = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n\ + \ ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n\ + \ QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n\ + \ QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion\ + \ = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n\ + \ QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n\ + \ QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n\ + \ QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n\ + \ QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n\ + \ QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint =\ + \ tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues\ + \ = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet\ + \ SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime,\ + \ EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string,\ + \ ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string,\ + \ SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string,\ + \ RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string,\ + \ SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n\ + \ | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n\ + \ LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n\ + \ LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n\ + \ LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor\ + \ = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor =\ + \ tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n\ + \ LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n\ + \ LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n\ + \ LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId\ + \ = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId\ + \ = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n\ + \ LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n |\ + \ extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n\ + \ User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet\ + \ SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL,\ + \ (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string,\ + \ GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n\ + \ UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn\ + \ = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo\ + \ = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n \ + \ UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime,\ + \ StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string,\ + \ SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n\ + \ MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime\ + \ = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n\ + \ MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName\ + \ = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n \ + \ MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId\ + \ = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n\ + };\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL,\ + \ (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string,\ + \ Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string,\ + \ RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n\ + \ DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n \ + \ RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner\ + \ = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName =\ + \ tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n\ + \ OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup\ + \ = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view\ + \ () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime,\ + \ CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string,\ + \ TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string,\ + \ GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string,\ + \ ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor\ + \ = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime =\ + \ toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n\ + \ | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn\ + \ = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n\ + \ RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n\ + \ RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema =\ + \ tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName\ + \ = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n\ + \ RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n\ + \ RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance\ + \ = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union\ + \ isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string,\ + \ TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string,\ + \ FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string,\ + \ FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string,\ + \ FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n\ + \ LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n\ + \ LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n\ + \ LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n\ + \ LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n\ + \ LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n\ + \ LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber\ + \ = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n\ + \ LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount =\ + \ tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view\ + \ = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime,\ + \ Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string,\ + \ TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string,\ + \ TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string,\ + \ TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string,\ + \ SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string,\ + \ InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string,\ + \ ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string,\ + \ ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string,\ + \ ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n\ + \ TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n\ + \ SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime\ + \ = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n \ + \ TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n\ + \ TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema\ + \ = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n\ + \ TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId\ + \ = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n\ + \ TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes\ + \ = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n\ + \ TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n\ + \ TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated\ + \ = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped =\ + \ unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe\ + \ = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated =\ + \ unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n\ + \ TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n\ + \ TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n\ + \ TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId\ + \ = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes\ + \ = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes\ + \ = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes\ + \ = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes\ + \ = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes\ + \ = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes\ + \ = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes\ + \ = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated,\ + \ TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated,\ + \ CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string,\ + \ TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string,\ + \ TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string,\ + \ IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string,\ + \ SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string,\ + \ UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string,\ + \ IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string,\ + \ LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string,\ + \ InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string,\ + \ ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string,\ + \ SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n\ + \ | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n\ + \ LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime =\ + \ toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName =\ + \ tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema\ + \ = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n \ + \ TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n\ + \ TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n\ + \ TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n\ + \ TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n\ + \ TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n \ + \ TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName\ + \ = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n\ + \ TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema\ + \ = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n\ + \ TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n\ + \ TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n\ + \ TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL =\ + \ unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n\ + \ TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn\ + \ = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType\ + \ = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount\ + \ = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n\ + \ TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n \ + \ TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging\ + \ = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true\ + \ SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string,\ + \ CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string,\ + \ LastName:string, Email:string, MustChangePassword:string, HasPassword:string,\ + \ Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string,\ + \ DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string,\ + \ HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string,\ + \ LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string,\ + \ DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string,\ + \ DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string,\ + \ ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n \ + \ BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n \ + \ ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime\ + \ = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n \ + \ UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n\ + \ UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n\ + \ UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n\ + \ UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword\ + \ = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n\ + \ UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n\ + \ UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n\ + \ UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n\ + \ UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n\ + \ UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n\ + \ UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt\ + \ = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n\ + \ UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime\ + \ = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n \ + \ UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT =\ + \ tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n\ + \ UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n\ + \ UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n\ + \ UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n\ + \ UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n\ + };\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL,\ + \ (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string,\ + \ DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string,\ + \ AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string,\ + \ WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string,\ + \ ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string,\ + \ EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string,\ + \ BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string,\ + \ RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string,\ + \ RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string,\ + \ BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string,\ + \ CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string,\ + \ QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string,\ + \ OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string,\ + \ InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string,\ + \ CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string,\ + \ ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string,\ + \ ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string,\ + \ QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string,\ + \ QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string,\ + \ TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string,\ + \ QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string,\ + \ SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string,\ + \ QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string,\ + \ UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string,\ + \ Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n\ + \ | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n \ + \ | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n \ + \ QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n\ + \ | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime\ + \ = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n\ + \ QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n\ + \ QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n\ + \ QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n\ + \ QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n\ + \ QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n\ + \ QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n\ + \ QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n\ + \ QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n\ + \ QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n\ + \ QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n\ + \ QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n \ + \ QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult =\ + \ tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n\ + \ QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n\ + \ QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n\ + \ QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n\ + \ QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal\ + \ = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n\ + \ QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n\ + \ QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime\ + \ = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n\ + \ QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime\ + \ = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n\ + \ QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n \ + \ QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes\ + \ = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n\ + \ QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n \ + \ QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime\ + \ = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)),\ + \ toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n\ + \ QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n\ + \ QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n\ + \ QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n\ + \ QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n\ + \ QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n\ + \ QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement\ + \ = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n\ + \ QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n\ + \ QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n\ + \ QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n\ + \ QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n\ + \ QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash\ + \ = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n\ + \ QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult\ + \ = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n\ + \ QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime =\ + \ tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName\ + \ = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n\ + \ QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n\ + \ QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration\ + \ = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType\ + \ = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n\ + \ (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n\ + \ (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n\ + \ (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n\ + \ (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n\ + \ (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n\ + \ (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n\ + \ (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n\ + \ (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n\ + \ (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n\ + \ (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n\ + \ (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType',\ + \ ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr\ + \ = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n\ + \ LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n\ + \ LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType\ + \ = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion\ + \ = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor\ + \ = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor\ + \ = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess\ + \ = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode',\ + \ ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId\ + \ = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection',\ + \ ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId',\ + \ ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp\ + \ = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp',\ + \ '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId',\ + \ ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId',\ + \ ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName\ + \ = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn\ + \ = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn\ + \ = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole',\ + \ ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n \ + \ UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy\ + \ = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime =\ + \ todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime\ + \ = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed\ + \ = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId\ + \ = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName\ + \ = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId\ + \ = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName\ + \ = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId\ + \ = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName\ + \ = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId',\ + \ ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n\ + \ RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName\ + \ = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment',\ + \ ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType',\ + \ ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId\ + \ = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType',\ + \ ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup',\ + \ ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn',\ + \ '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn',\ + \ '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n \ + \ RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName\ + \ = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog',\ + \ ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n\ + \ RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName\ + \ = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption',\ + \ ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n \ + \ RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n\ + \ RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType',\ + \ ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance',\ + \ ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName\ + \ = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId',\ + \ ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId\ + \ = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName',\ + \ ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime\ + \ = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime',\ + \ '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount =\ + \ column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed',\ + \ ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n\ + \ LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n\ + \ LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition',\ + \ ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n\ + \ LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit\ + \ = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId',\ + \ ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName',\ + \ ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId',\ + \ ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema',\ + \ ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId',\ + \ ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog',\ + \ ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId',\ + \ ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient',\ + \ ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes',\ + \ ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes',\ + \ ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes',\ + \ ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes',\ + \ ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted',\ + \ ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated',\ + \ '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped',\ + \ '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe',\ + \ '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated',\ + \ '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped',\ + \ '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated',\ + \ '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped',\ + \ '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment',\ + \ ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes',\ + \ ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes',\ + \ ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName',\ + \ ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema\ + \ = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId',\ + \ ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner\ + \ = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType',\ + \ ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg\ + \ = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic',\ + \ ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey\ + \ = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount',\ + \ ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime\ + \ = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName\ + \ = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration\ + \ = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog\ + \ = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema\ + \ = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName\ + \ = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto\ + \ = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped',\ + \ ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated\ + \ = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered',\ + \ '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n \ + \ TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted =\ + \ todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn =\ + \ column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment',\ + \ ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n \ + \ TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount\ + \ = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes\ + \ = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount\ + \ = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes\ + \ = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging\ + \ = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId',\ + \ ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn',\ + \ '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n\ + \ UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName\ + \ = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName',\ + \ ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail =\ + \ column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword',\ + \ ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment\ + \ = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled',\ + \ ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse\ + \ = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace',\ + \ ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo\ + \ = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid',\ + \ ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil\ + \ = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin\ + \ = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt\ + \ = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime =\ + \ todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey\ + \ = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime',\ + \ '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole\ + \ = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT',\ + \ ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity',\ + \ ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName =\ + \ column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId',\ + \ ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId\ + \ = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser',\ + \ ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified\ + \ = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId',\ + \ ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId =\ + \ column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName',\ + \ ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName\ + \ = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType',\ + \ ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId\ + \ = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName',\ + \ ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId\ + \ = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName',\ + \ ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n \ + \ QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber\ + \ = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag',\ + \ ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n\ + \ QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage\ + \ = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime',\ + \ '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n\ + \ QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache\ + \ = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten\ + \ = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult',\ + \ ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult',\ + \ ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted\ + \ = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated',\ + \ ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded\ + \ = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted',\ + \ ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n\ + \ QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage\ + \ = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage\ + \ = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork\ + \ = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime\ + \ = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime',\ + \ ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime',\ + \ ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n\ + \ QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n\ + \ QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime',\ + \ ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud',\ + \ ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion',\ + \ ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes',\ + \ ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud',\ + \ ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion',\ + \ ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes',\ + \ ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime',\ + \ ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices',\ + \ ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n\ + \ QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations',\ + \ ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows',\ + \ ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows',\ + \ ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes',\ + \ ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes',\ + \ ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement\ + \ = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned\ + \ = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned\ + \ = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor\ + \ = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId\ + \ = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime',\ + \ ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash\ + \ = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion',\ + \ ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n\ + \ QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion',\ + \ ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats',\ + \ ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult',\ + \ ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause\ + \ = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime',\ + \ ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName\ + \ = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId',\ + \ ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n\ + \ QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint\ + \ = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration',\ + \ ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType\ + \ = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName,\ + \ UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames\ + \ = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n\ + | extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime',\ + \ todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n\ + \ RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n\ + \ UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type',\ + \ '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n \ + \ LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n\ + \ LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n\ + \ LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n \ + \ LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n\ + \ LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n\ + \ LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n\ + \ LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n\ + \ UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n\ + \ UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n\ + \ MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n\ + \ MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n\ + \ MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n\ + \ RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n\ + \ RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n\ + \ RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n \ + \ RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n\ + \ RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n\ + \ RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n\ + \ RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n\ + \ LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n\ + \ LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n\ + \ LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n\ + \ LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n\ + \ LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n\ + \ TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n \ + \ TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n \ + \ TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n\ + \ TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n\ + \ TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n\ + \ TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n \ + \ TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n\ + \ TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n\ + \ TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n\ + \ TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n\ + \ TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n\ + \ TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n\ + \ TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n\ + \ TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n\ + \ TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n\ + \ TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n\ + \ TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n\ + \ TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n\ + \ TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n\ + \ TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n\ + \ TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n\ + \ TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n\ + \ UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n\ + \ UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n\ + \ UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n\ + \ UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n\ + \ UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n\ + \ UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n\ + \ UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n\ + \ UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n\ + \ UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n\ + \ QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n\ + \ QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n\ + \ QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n\ + \ QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n\ + \ QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n\ + \ QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n\ + \ QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n\ + \ QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n\ + \ QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n\ + \ QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n \ + \ QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n\ + \ QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n\ + \ QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n\ + \ QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n\ + \ QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n\ + \ QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n\ + \ QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n\ + \ QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n\ + \ QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n \ + \ QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n\ + \ QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n\ + \ QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n\ + \ QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n\ + \ QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n\ + \ QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n \ + \ QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n\ + \ Type\n};\nlet adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\n\ + Snowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n\ + | extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n\ + | where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\\ + S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr\n" entityMappings: - - entityType: Account - fieldMappings: - - identifier: Name - columnName: AccountCustomEntity -version: 1.0.1 -kind: Scheduled \ No newline at end of file +- entityType: Account + fieldMappings: + - identifier: Name + columnName: AccountCustomEntity +version: 3.2.1 +kind: Scheduled diff --git a/Solutions/Snowflake/Data/Solution_Snowflake.json b/Solutions/Snowflake/Data/Solution_Snowflake.json index e4d5d88efda..6a17167dc21 100644 --- a/Solutions/Snowflake/Data/Solution_Snowflake.json +++ b/Solutions/Snowflake/Data/Solution_Snowflake.json @@ -38,7 +38,20 @@ ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Snowflake", - "Version": "3.2.0", "TemplateSpec": true, - "Is1PConnector": false + "Is1PConnector": false, + "XDR Workbooks": [], + "XDR Detections": [ + "XDR Detections/SnowflakeDiscoveryActivity.yaml", + "XDR Detections/SnowflakeLongQueryProcessTime.yaml", + "XDR Detections/SnowflakeMultipleFailedQueries.yaml", + "XDR Detections/SnowflakeMultipleLoginFailure.yaml", + "XDR Detections/SnowflakeMultipleLoginFailureFromIP.yaml", + "XDR Detections/SnowflakePossibleDataDestruction.yaml", + "XDR Detections/SnowflakePrivilegesDiscovery.yaml", + "XDR Detections/SnowflakeQueryOnSensitiveTable.yaml", + "XDR Detections/SnowflakeUnusualQuery.yaml", + "XDR Detections/SnowflakeUserAddAdminPrivileges.yaml" + ], + "Version": "3.2.2" } diff --git a/Solutions/Snowflake/Package/3.2.2.zip b/Solutions/Snowflake/Package/3.2.2.zip new file mode 100644 index 0000000000000000000000000000000000000000..5aafa3b71b45f067c8bd9830d04b820a404c3327 GIT binary patch literal 428681 zcmY&;V{|4k({|0RZQI7yw#{w3wQbwox_52cwr#gtn|IB3pZ9y8AK#yxoaD@$Tr-nN zu1u6OsjIGGx`n5tWfnVMPJS-M!-+c8=> z+uLp9+uCn(zP$&0hC}y&8$-8bwOnjKts=Dl){QRKPc6DYlt!LgFp0*BQj?~wX{B@M zJ@VW5OdJ&L)@t}oWofgT#w1Mt2PyZNOXUN2Q46Bu&*2w=Vtpk-*Tl)$`RVsI6rKK? zEJjHu{_~H;gAa!3jhz3e_aXoFFm5eR-1|Fj#;|)WlEWB9tDf|YJSqJ*!~K_K@`r5Y z#R^=;4+txr3xwxpRx68ce&|jJ5a36MG zkh%S1{_o(kyk>Y&${%jgT;OJHhJY(VC<~uylg#Q5F2dM8i|-@PeuC+dorq0l9CE1U z+9C=>6nlJ%v)vt7nMsN$zo8iMZ9z3M(*^gm*PpX`@iV$6glo4)o)_zjF9)7b~A@zWeGAOpYkB2u$EIQ(3XDvNnS;!VRcqPgQ36nB(6ci5&6vK0+%@(3oDL0<5u8X4mr z2A9SeEPjP@WR=kC2-~aHsBW?^Q1}5qhuZg&ZC5k0se7mnY@{)7DxGVp;8^Zf zkU3y?EGo{iY(7L*mxZ?4LE6o$d=X>90vUR`JB?P$Z31dCz?>i*j5tfHcpYXBL1+4t zqQ94%vJS;Sf@Voi{{~55S@G`zE%gA}VGbf{lJ`=1M(&3fjJISh|3c7Gf7Y^rNZv!N!HK4r>CDdd6;Met};V3 zZ~1D6;&VdA%z3}|&9V}E=?el(H7x>!16U?NiUmQvbRt<>AS&VIpnj=^ch z4&4eXbLN`;=g(s0uERt9kN7B`K2scNd^+2AFiE+G#=hOc(g6x`xd;05v4@|(=o?{% zP~o!j=E(;ZWawe^CG!TX2gpdq55wsK_GF#-^Hn4{y4?g zFK9MvrOcjR-4N*$!kS5oF`nDn6Djf01Yjrj7c$z|6S2rwXny$BJ}e8BSDq#Dj}Hww z5yhbeo*fW)eZBXy;OB|&h7O+rHDQfdz~IpMa{mPu0qG*EIuWN*r0v`TuDpVXC-QY) zZysVX%x5$e77Cw|AC>%JL)RpEu+zS}%s7Y+ZmdjGyrd9jv0{`i7)6gp8^rpipFHr(yTHI9&_HqpbAuMxf1-s ztUua91(7~zEYI8rpxl%J!ht=*d0?BGtgglopEie91)>>Vn(H%i|u6r zb1x*qCYj0PYHAqGes6nC6&cm(>vPqobZ2avjCkgq2X}d$>J4F=xO30+$K6#G-me}f zcMA3=p7tm68YczIgvz;A`g|tL$Cy>urc#A8}EH73Ff96`~vx+1)^oxigWkD&=q9Y{sVc;j#WmnucaJ zhK)BM-_fh5^>bJAG9>P?nXA!7*D}97j~rmvZ{ysh0+4;ixr)8yE0$rRnx;mWOtT?= z%^x%TB60FZ{k@zqL7Vd&%@a16GimpdSxz-w=SQaN@+$xu8=hmF4Mfza6jSP$_RBBg zYk7BhbR!0AeKX+S34m&pZD49sWyHMvjb5O78fHTqPnAdG7c|>+jGfThl%m#@?RaO- z2ws+V;-p|F|9D0tQJ<%#bP$mg%1teLY%;2gT!-n*KRc8q*`i(KdB!MT~K!=QQsr$X=!Dmk0$p^AkB)DZMPZGM{l4< z`N!#dC2qG#kq;}CTu(jB@N-o_ry4_Xu4joaL8kaJbwIjOJ#lQxS?wGeI+>L?L+BX6 zRdA#q9SLvY#qWp}gW-GE$$B%M7>mio$fQh3{)TOkfu^+KlDWnPLcc=?G=(1CqME-$uImb(WFSilbF9;Rb9vHQFQs?%0V>z_EizBM7gvHDu2r>rcoQJ`g; zU**o0H4)VLU`_|VuTMFSXESE1Ec@7vXPm`HZytReGL&Ao@IYo-HmgA)K)~N7>!zVH z;(M;DRY$EC<_yO_Jvs6HYi~qeAG3toCn{5KO8;8KcAbx1Ec@7#ZC9qRkLG>tHOa2` z9NQR0S03~Ws_pBcKSE!#vgv2Yrk9D$$|~vM?Dy}?738$KFH<~(`y?w3N<(F+PU@+p zbo3W3RTdG_wo4C?*h0y(;absXsMi<7v^K9-OnC=QR!UZ;@-Qqs6xe_^W9o;I*ALgz zM~5`R|D=vQK0+{Bt*CLc(ATY9%eXM_^M+_o6U~AAutaIRxrD;qv|29c`Pv{49<&i_ zc8TNo8i7E%kHf`q%ozAXI&-$yY;0=dx)Ydq1hroJnp281*!h+P*7)d+rwZicVYOY% zpH4s)muo>H8`-8_MU`>ail|&cv3`W`nGn`H7fsc1M(65)HpyryW&jl2YiI8%;@nI* z7RveYNZ6uPTF^CM(TrCw@H-vM4BeP*xEr4kWSxv>ZRG!wLaDS8J=WF+51ZEF)Y&wL z`=Z>_q`!f%#a(8IM}}d-n$!3E<*|LX@>|v0!BJ39&jy+OeXrnDJBr9o?=r`)?LRBs z18bDO9b6{Zl$k`Z(I^IFIy1KJDk-#?0o*H{YgFw7JWc>^R9>9qc9{knjW1uH)=f?6&S$$p$6nV-qJwsW&msPqjlhqDXPcj{Kfh(l6(L8CI6vduux?S?6U)1j8xy z(pVDkJ0B}^`C`giywAt%!&eXS`z<^v-bhkC&EFzaM?Mv>G-3?;Iq|)1e5$1SNNGnQ zXycI6)~V-77}CoGd$EuM36AH;W(>8(vJc}}X%zzG<{p4 zZD{Y@!?99pFS6KXS@a1Q$tL)CP_4=qVRA<`e zj9Oewn{y^y&(#q-jK=AU>lu8h_WH_7H21Z&Usu%dS8Egt9iJgp1U#+7@Xt4QGt5u< zoL+3KnsdbrEDj9~3bxniU?;3o8g6zV21N5%8o06A1!+}E55xGTfGV8d8%X6LF1uel zK?nwK9Qx~3lO{Mk=qB_ZB?e^3^FJK!?dul5reFDH}hET7-TWG62 zyQFo{rV>Ax*$>B~ILJTaJSfiZexogu6+auDj#S{TjLI#J|9*4BX_#%%EFj*sNenvW zoktRr*I54kV%hF>l>fWzkx-ghL_EmajwH&avCOu+itXSIw?eL5ey$yv=+h}JlbGgy zknnCa0+MyD*BJ2u=Ucr06O$jAUq`+7D>-hvS~5DvHW71OqJt=`rmEuNTcPAxr`X1k zSu>w%mTP`<&X+j}dvAL)clYc5>uOLb8OwUi&RiFPPB{ZB6L37E^3D8UR-B1-aXEfv zleqJd>$(qk5;J4WSBi{HIv*xntW@wShWFPo7p;l4^*{b3l!LnR-nyF~MuJ77%-v%= z8%txFD~A6`n-p$e_@TJXk+Jc)Mxx1l!P9-Nv0 zunTu+bGW!_===6o`3ypZ<*s79;t2?!N+2zcB zK`5!0K_p}d%|ESebLB)LqKwJq1&EP?lKZ`E_I}ACUw(M=dPfiyX5R#5htunp?sofR zly-TRxry{ z@93Bel1LD!UagdW@+X{RSI*aqpg&etBf-!sT;8XV)tDrvqeb7U=Ipm*z&5|5ggj!>Xq39uloqZ_;;%I!;hW|hzwe>f^bu;f9G-l?G&<@0TPBk; z>OQ|n>W#;cL%yq+$*s?CYj$@reQw#^`dvVO1fFclAwfcyZJX$-T$=qw3!k&#;fK5> zVA{_bcXG!!rqRzUvq-$b$Jub1MjX9J|8irXEM@Xg=cO}+_o=?(fx)#SmicPK5r6Xi zNeZ(wEZiX1$PIum7k)y9{{FnM0?Ky8nK>3#9s5J~3XnI36H5pG+j9aVz`u5lUde~u z8hO~iFQWYYXTQhrcwyXZ{`g&4bN;?MezR=RnJKWbcgNn9t=58UpMkP0r#9U!5-vn3 zs-J_)=h%Orn1HhEiZI`=-42$qesY`q*#7)Py0%{x$arPd+3XT{)z>ztiy?G=ys5qp zUSZYYGasi%@bit}a#TX7RqmQfH0?s(&Ky}^1bm>&$G*>-bm=qc3<|3?eJN2FLp+Pf zeKl|T>%O_b7uy51qp7E#79L5*pYoczKe5I?h}V2+mW!@6MWlsUzeAYNqdYowKAo13 z<(s#;G{TlFA^5Mf%L@lmlR3x*^T|eQRF3u*!M@`*m#u{T#ale1E>_r>v{z6q-^pXRaESaM@Gs$zHTZ4ojWG$_qHeO?1L>sc8H_RdCoe0UbD@s!vt?D9glGry7S56rL z!|zP^u@5yillJ+(6LAP|@j||~^Mw7GrMjPZpMbg#DVo|3Wllh2B(E}Nv*x5J-(=C` z9g-cDFg-3gQ|<~Nm{@mvbX~Ly)=$0xx}jp+WyYRzXQUGFN5fKcPJiaWwJQt0zp@jAMPV1RwephWg+hBq{F^a&v+b6mXf^fu zJev4}LAvp`XYHkw=o-pdhPdo2NhY^eO~bF8qWLS*9Oz20=STz4kP^iHioy2|nx+ln$1 zJ2i4!)jsLjmfG=@$GbJ@{+?OSrue$!aFvG?YM47Mc`R5rm+F;mqsI{Hd4kSLDzIvkTbjW#vf3CUr(fj|`t3 zDIc7&_QWbE%qkWR{!|Ig%&i#^IC`&i0MeD$?P@M5?H#Xb8r9lwh=j)L)B0TgN6*7G zX$LpJkaOl_8aOh(y=_Uxn>8GpbUbW{PsC|Hy$)GEF#3OLZtpZzjCyO!@&`r@4MV$o zEa5Q(9LsMbd*NgkUT$4De+mfLO(`-m;Zco-yT?ur0<{l5YCKW&N2q{>o2n|IiURtf zz7x-ydr7rL1Ad0eqM?dCJ#gN>i5Q zQ{l+?ytIp_pNprH6CauS%fq7jTB(mehQOx`?d3BDhuX`-MP=P8mu>!lIU|MuP}4}7 z*Lp{vFqdl%(>jvQxFDc=m(x@CGa0yLUjZCHs!8qc$5PMf<0ITLpJiFW< zP%SGy0u$w96;~7Kq5BR<74ohDJX)i#o|a8Y`UOFIAtT7!V2F?>%#;P&JtRmBrM#v* ztZFh;J+i5hWmA9L7

@Q(+Us0H{1`E0TbXa0rS)wuG(y)mctR(9_0PIj)I-VVXQIt<(!ZRsMCfAeY(VQ#<% zXQyXo&9UtpS1mbzSJw25y3HKpTs6Db{38ddp6R%3HI;{#w!#ijWv2I_WW0- z1Ms}m>j?zUNIJc(;t{l(VpO!pqiQYvm+>Z}lO$XSceiH%clCtp{Tw%EnpOt6inlg9 zY?{EF*Z*LOW{QhfIM^H+)^=Irj*L^lOPgNwB;ysx9mCw{Tl(vyf0eIDEKlaP-EX#icR_Zgw88zph_x=l_G^Uwr)d3Nd@! z?Z9yp>JOAzn2hdR1RfM7ja;pNv^hGt<8v_X7Y>eGUfx^yv2^nBWWIYLVi}fu`U>Jg-$i?ga8lCxzOv_Mu0TrChBxT4Vro~eeKBD1yv!}kRIeZ8;ihEw4 zl;OV{I}@rYHiuZSQ?{L5Ee`ct>@K{eO7G}zaWW(rn-plzIaA_oI=pmnA~hYfW(z>y zO4l-CEPj|LgG-g>>zKng# zP@XhnlBpHuoT}P+uPM4dzdP36$YkX}-pLqrUL22?Q}z$~5b#_VZT{UyOFuHNqD6N` z>NbFM0NHG}KC&2BFwWx4@aY5msQmh!A)=%gO(C7F`{gE79^8#>|Nfk4A#f~6a z*E9GPp9tm)HpRJHfkB!-$Vxcv*vLm&sedsI=!WV{3`q6CjaP}=^7NP}l;x|UHL3BO z7rw+fM>Wq=1ewMGaJ+t3Y_!K1g-fycX_|2Vb&)iOjC~XFyuvzyLmAJ>SNGuQkh=te{(xNJK;J#|Dk)N42TY2TasL=(!LLFE?cN9!r$M&by&P8~Aal?k+ z)O%rGbnLQ*(S1x}AHexXn>#^aAFYn1kmyY7CE=+y3h<`e!d4Ce76U zh@nw0GK1TDhYm{onHN7+ca>|==9{=~0Wqk~@WH6%8+d>7ZKU;M{ZH5Wm~>CXmB+_g zguia|&y(O%`kf}u%v0^Bp$|_Se#%CEP?&oA1Ti;x6Mzbw?|H z6m$gq?^N3YZOW{u?p*h;&(L{*;0-=VyObd==P-JyToegRT=^5}ANhax?1r{9djGQ- zOKGmb>&+GJtf!7oqLOVyDveOQUkgy5eruSxGg2^Icql#0lAD&?_&-XogsEI$+u|14 zJ4#LU!V8rzIOrtG&^M?(?dzw1{V4m#-5R)M2~A+rk}o30e!?Ik1s&gg`OU#JEE_j> zwZZ_XpaY3t4EyJU)x}r@k>4J^!ruETejV`{+U5&4}HKkh}D85Qw5OnPn?;<~KCE8+B{^u#@6V$b z8Ux$V7nzvsC^gYF)R>u_y)jD*l47y=?CWK zHw8P~f)w25-H=s=8=a%X2rG<+j|&Q@1>5BP>1E4U-C7;8Z%n#klxEd?CBgm%xdD~Z zE}jYLuMf^sx|#2SNJmW_8xkb|Nn20ZATiuaK@Zp(KTB^Gp}~El^O&s*kGC(u(H51o@HvPCxFV^|I#3Q(`Y+Qr!fiIu$T3tH3h5z_GDY8Gm-W$IYgNu~~BgDbB&< zH~N7fr3;wBs1Ij~e%(atfkZtd-tEfkG%jI7KiC49c7y4p&Jeoe4ehDsPVD-WRC;5V zS?SAMS8tN$-J;*<(IDEYRwzQQF{lkGDM?uiqE=WSoykc{cCotM{nkXv?e?NF6Ww^d zlD|eh`(eH<;}%XX?7S^b%OlgAJvDu zuK+Sq)G@?sutyqLTdaKO&vLu+_Bx_Y&LsA0@&F!%$a`?4+D209 zx-|NOuf+p~^C!`aZacxOC#u!jvd{p=)=y+u<-23ElnJ~^#Jel5YNJYi#PG$;{<6vJ zHp}8F%%TC%_23-QXE-Ad=roZvMn+s9OFqRz$Le;yx5^m7ADiaL>w^pKO>(wTLWq%D z^BmSFa1txo0*ANzBM8UzB_q$DgZ7(#+70?>4d9^$h zBF;`}^vYi!qEqHDbZk319GH@In_tlLx+<$;4t&$FaZ|))Ebm1HWNCZ0>sGT-|H%T+ zs}8o(d`eo;jF@{eZk{5+h=7R`7R>4)M5N?$t=Nzs&9umfGO_)*_2aX7l-y_D)Ghh} z7H7zB&iXcizHSxYX+L;Y`F!ATxSKa_!nY$vbO1@A0Yx4gUfpU`TXI=Rtz9%vpuM+1 zzKs4erjc5E1X#H&@q|y|haIQ8-NWo_+>)HFRhwt*C}qFAq_*i(8}`G@(SA9ZJc3Oc zV`IH)#kxf4`K^V#T-l;+YG0m@={=YJV?zH$J$t~J?%3kQr{Vw!a`REvmEA=^^1gV* z>U02xSD@vp{(E(&Kx=gMc#+l6rn`3g8U~bYa;t`~n?&(-SfJ+idvS;9qUTX(%S^VC zN?$Xmd9dD%w;PbdX}16?=@`wQt@sQj7=7^^>9=Fv3$HUeQ z1U!G9++K88x?}E+;8nqP6k4_t^uUF0J-aU|2uwJFWw=C7%S0n1A08a zt;U}J?$co8BTl{(8QVbjY-h%d?A2}h^M8`~%))H=k;yiw&g4!m;*IQItGO0}I1-8z zTR0{K;3?nj+hOkxXL|6+ras$x)&^{FBY0~r8hKzK4*Kb`%X`md>OJd|^`aB?#-$B6 zOEitNZ#lg2UWSX}^iRNG7&)W%Fy%zg3&l&}jBdcz7SS=>Otwjul4LdUw%C+HvWlTG z*uuLtIcjo4-BBj_Gc{tcFuoT$Xsx{pxSDC`M4oI356};JdvQr3)+`^GBsQPQf~>A? z->FqSuQ7hz!z0#<@90RG=WdbMx3`YzUaRnC6KV%-uG357Q{H*0*T zTvV;7wp3Ixdi8AsVxU!jd3s*GK%~7b?yEF8-mh;t8e!w_cqrVTxQ~1r^*ciD($Qib zFTZE5Sg?2ZSjkg;I;P!@dy_p)HFssM;dNa(4A-Ra@s>GTPN7&>K^V72! z2kCE#nlN0P~en21naohYSfvcSc5B^Eh6+@RK@=vqTU1FY7y` z^Y(kNyJq(a(wg-K{{70RajH9*JGT>ok(Y@N}#f%vzRKZe&hr9)hOrCoD zv}D;$mhAdHIq1b(aL@jJ;Gh8*(mu9t(A6fon(Iah-kJd0@lh2b#~u7kDN|dk6H=gW z*laPQIeS5kF_mOW8IEX`aW5UqAx{Bonpwb3S7R^3CeB;;`Z4NVM}eTM@v_OgK4eMv zj{2MB6B4-lQ1l*YNS}~&zvO98Nugn$b(kW&3vJ-Urcdv}2JEQB|b@SmXC_w|4 zd>xC$Te~cMYQ2LFx8PoPs51CZhM{&W=WHAaU{}Ky0jMObL*G0t-f`H#xM`>@Tx8=O zE1`3!2q#=gz62L2x`Kfk5M-!%NbdjTIvl^b^YLDPyeufljxJlvz>F?hg;Wy3k0&gJ zqDs6VA<_ag-jBCa1(MlX-oF8#QGk>uvO@F%cfzN{6a5ZlEI%Aw927tc2XFlVu=8Rz z_LKM5TfC{5b@tZd#8D{oaYg*I(ebLF6#<%p_^{ZJJzrDziC{bdms8y=kR5|{beg!I zAV*@r+`JHEjPjwE6|>}z8F*aR?@3wY`Q{X2$!AROpx;wA^+aP~6UV%md(cj`IE0=b ztN`&zijM2VQszbF&gC1`XeOFt%AKiwQ_Str(5lMm^Lm15!nx`chc(3agO!WAWWH`( z#G2A8jd%Ieii=M9MAN&(s*6q|cRs}T9OIEnqbvai*0i=W4`za}LTUR;RK6Ip*E_`a z!8&!HX4OlFM{B@OY_+y$3okZ&7fRcf=#cb}h!D&qqIm9MxfSCc(qcI~UWQg=UT#@9 zBeJFn06kWv#f(}p6QfU^@$cICl=03<{Y;|V{ZbDIrICGy+ZH;TmbJg` zZ3^vkMqP1<2qf2|(%i5=|0SEnbHvX>1c4E}d7G}G{!Is|?bP|IIBq$t)9A{h%1}KM zmA$EbEq*~DpojL!oS*?(asBGtk_XE!fc}ILlO$MCOA>+dKr>jnm(2e8*!)E^KL#($ z#R`)p=H@Q=XF-h73xIEo3_c&RCz3TCc)QiF>(#2(+AA+g0-10XlJ?hzvIwRkKpSn1&i11g`e3dz%OeBUnawZa-I0>m?2HwHHl3Mw@h;P0 z18MXIYLJM#)$*}T0h2X7h?fCRZ`Z|}2Q__gZmlo(fi+E+Gx0}Q~23F=5D`NPkhCMCgO03@1Q6x=NmZ3^S{)!9{DE=peW5)?H z(>^srf9bqZmH~BY3cZwmKDYS00K*YF^|X-tYkh#y2uHcinY3Uo0?;?!?)!>(v>I=j zLFotE9^x{!JR;W~*)oGQ_U!(l316-D4zo@8cI$xZdV$=X?~+`fU!JwduiiSl$aA!8 zXIDTW1?Jwb`Yv%=;q^O*LNL~P7d$$gs1}1moKM)Coe&Q{h#m9`m$5#|}rS(jhcYYi@CDadniw?LqtNT+yCmMn_qzR;C? zQx?-{vx^_#sbu-)flp&`DiW{-<$BsNx~@ameBMrT#b>%$%;WBnA#X=BZeF_SX$MX5 zYP2(+1Z< zPI@Vk%{a3H9wx4vQzt|p^+mSV(MaSGt@1vWE(}_q>qC+yq^Gj{A$zCb@z8N~*l>BE z3uK37i0O4NFuRfF(8?dBJ-%YF%_`Z zYh|s(L(O+?0Rn1y2yDm~LJlTMZxN7t$fNo#Sg3xYPp$H6yH+5s=UNu%51EY}4L;bh z#(S}jTLej+5it8z9B`A<88%=+nT=c2Yn)b1`~l7SfY3RAQ8-Q~S}iTfer_9U1=Zgi zPuc0qSrG|n`6kNFZ<2)y&N5?0a?XIUztYYM5b%W4JSg-E>?cCp#QDlMfdhVSvFVAY zNWa44v)tNV1HlcCeSV`^uWu@3Vo&T);tsVrOw<&TIG-c*$Mg6?;W1}Dkx$?}Ycy z2k<;uCleHWI4#1$on7GSA@{6ubTRiCtSX5ncYfGZSr0EANXtlnGB=VrLhL_Z`yw&YAn+Dq z#8w~8L5_<*UqfakRwCFGgxaF%Sv`QZJ!i$>p5*$?gN~YXgszrdpp-xls6axmDHB(1 z?g~O^wy5}1GAGOcu-Z^1&cl@FNJn2P6?cBkhsvWeCmxpyfBh&uG1IfE$+z1sBzE z*a$_X2;6T|%dY~#8ge?|1j%AZ^zYVnJtFG@p@soHL+ikw4VCPg%k)zc8h}Q-sW0)Q zWxLThktFrA6|<)VA9}RS%H;u$rOavGdrarjt^=<}U_Iq@l9%g4qNh%6j$Pq0U!|rj zQsl|wIkrURaAT7dsUE$7MD%6GA3x>V9*$yJ|KI@dM<=3hYC^I(h0rC-c@V*@t#QaV z(FJ75B7w>cF9jWf_^Hj$iX-b~hpJQlUnX*ioirm-&YqehbAduB3g$3DDjoVn0YYa_ z_Htd)t%ie)U3)q(15yo@D(Kva`Wd_^r0Zo6P#=F{mHyrl+?_&%rQkpqpA9=C5?Q{% z!n_r13YHOLZaen|mYwEowYmkmN{P8CmWQ&QNQKiEUKI#~h(6osG9X#K9l}77{HvGwF< zl!CHOhM?Rva(@{^uE6Xjs*^tvp6IWi zdR2KBgP+yUq=06PcBo@35MJn@1b9>>iTCZ)+odAdjlQXK#t~d7tVg(3!514X)-$3- ziI2u6Y>{69k)5kf5;iM+!MJCBO8tNiF_BHhw96g#G-;KzVCJe>8?X=|d5D6eSH)4{ zT)~7VGh04tDHB{p7qmoFw^m;GIkBWUxcM!>jpN!zupcl(53%P0W%Nsg4gI2qY66ID52i_r(F}v3T(f_&>A>4 zB1?>`5Vjce3TQuZua+PL__HxTGQ>#qqZslK;|f}TU%Qq$MDU*RCkpCh_@f+5AK?m> z9+>!iT=GO5RwSJ6xW6eRauTzJdB0&Y=fBCXu?MWE zL80lw9PrNjNW(}j!+0IEe!;Zn|M)S5HDF@_4!sxZfalep=S(6HZX`%ePa3i~N26Fq zBBlfcM3i)F%-Or?L#+ITTlWX z6g0S|a9d1``E$)oY|ZmVA1~KZp9$6lzP2iaYus=87q`8g^n)uh;X#8rAUL>muH9ETKL8nI&I`rAJ)6~1tm1NXF*L0 zlb(-isT3pQQI1@_E|=wVvbp0ft;ae4rTBKeYra8iTBC8+p$?u^D)qMC$49G7Htg0n z!A?b~n4tllFgjzJ{>KxAqAY$+6xB9xRaCWo&s(iv$A3*BO{Piuk1b>Rb>vpziN~*J zwQ|=4?*yCPuf<{J-#NZzlLx1IF9OWI@IFL<^Z4i|Re!tit{h-z6ooQcFdS;RS=Vv_ zfNSZ~l1#iKjB>g1#NMihCFsvmt7^WKsq6=+QpAwGEU(w9J_YJwYCKY6IqCzMLCPs4 zznbAR3QEpKO&kLq786lU%B+U1N_i9MgZ_8*Pt{@EA*nfwisgiqhiM+Ok^UyDmWJn>@>BbSr!gil3=>G8Gb}=K+ z@r59~)c!z}S7CEyfY4MO>HjJ5gmHO|OM*WI_(JHwZYaICdeH6!^@3zHPReHGQlIG_|-*4G7O+oOlb zQoIQ}l#4}gnGR_kGNi|`tz#_+v8ua|It@W~h0;sv_3094RG>Epy+Rk*X=iZcwLajZ z`dDWkfQ=tpDhbZYNN@k;P-U+`HK^Etg(g->@xZ}{)~o->!IB&Mlk<@6>2g9eXd}YP z@QX5rQqquhmhjg!Eq<}R=PV&-hae%K-k7w0u1Xy>G{meX#sZt&n?tN1uUsr-0UbV3 zAKSuoBMn?=Qk59Nt+!sz87#M4%zlZDt`YG8C$$$60$21nHp0xb!)U%jjf+|*jSHh3|^TdV=Ez^ve9QBaVk84yi_igL)<72NO1z|d=wa&{p?3C!g;gey=-SJt6? z;__Qt4Bi*m`kMvp5%U^8g$%%QhG zl|cfsk?IJFQd;bK3=eGeU4bgB=Ah>k2?wxY}8#e{TG19?IJQ3VoCt6s>a*r`?^ zq3(PXZd_0y#zk5o<1&z+YU!s`rV}=@--r@_khehy0UJ6&Xnow^ZkY<0)BYc#HG0zOnS498=HygG3fhCF0*`6#xQ zBZ^mDAc#(-$PPV>Tnc0WqjYXdNL3So7^p0afFyJ-I~)2yQAWPL0I1du z6Z?iDaJ}}>PH1jhkg%j)5R6bO#fZfAY1bpAs!;VkhD>qcCFs#Uj3Tb|kl2kAsveUT zi%A?KqS={#7&8pwg{+MMp-4IJkpQm8wMYs1KK?}sF zdh{b(-p0t-+MArz#;1$snE1-zO~Bp@7H6j(R1TdBb)9Kwgts5`>0${ zW~G7%8CG10OR$QB94kvT%Lx&xQ|gAJEQYKNI~+S^+xP)~LoUT0pb$I) zwij}t3)5st7o8d@)d@m^1bymv zbJ<89`Ccjv92V>h5y=SI7Sb@*S4 zqViM6vvB)}a+a>K-~bG(#$dBijJ&*T<0sxYxYIGt(6zn*fN7ykRos0zxh!|DRrpNE zW#O}fTr0vfGo{{duy6w`YynF2oCy)c2Rf-vs|hBfi=OiAY$E+N3_;Yt7=H0I={y2R zv=-z35m*>e&nJlQjp5q?iyX z_Sp^B$5Zt^Fc2!{m3QT+1e}qBLxo2lt$M0}jz4*6gO+%ASAi`08fbuwWAdPyBPDk4 zs0W<6d6Pi)x#$aWLs-)-K088^Sw}x(SX9^==>8fz7w8d6cao|Ah`Adi6*jlGFG&h|IWgMHu}Hw$-11K>AWsSGLeY=KJjpcBRZWCx;o>;^7xm zQt^omDJvyoa^lAI_++o~;;4icffD$G%_q09@4lKM5ndI+cR_?gM=he88Thf=)JNmt zR{@4@6nnyWsW&Na+T}yO`S}!@b8z<-`se5yBrL_UxS5`}8T2Kc zg*-Iq?LB9T(wLF+4IIDVU6VzlQ-!DX2rCDg^msbj`Bdz3bjLnDrTJl1uwyg2s{efo z-QP`Qmwk3~joJ?W<=#p^=mpbfyh6inb`S^>jd5%pBaR+DOuWD$a)|<3mp|)cDV!_Y zI6O`hWOOrg<&|fj_?Oj2C9Q3u_wJ9D(xyneyR1V$c{oFs?>I!7LgU*0-X>)myLccq z>{=S-TXPX{dS$j%STFH_*P;hX=(&WHS@islRKK_yIn2*DD>#zTl4i&t6C6DmX`yBD zp2tD;yiQ7qE-%s{?V9^%p$(o0Ixe)zcXT}&9R7HAh?L$($Eu5@ji`xHc^#J5+ z1h^VoX@Ty@vsIdN7)f)RuVuJWIiVR&DcA6Ang(Lm=)#UH^5f1bo%N2+^1MgnQ{C|> z07gaiL$(N=6;pnXYv=>u*W*MG1?g;kgl{ZBqLQxe6(m^phtaUm68J=zpS9~EWUXV4 zZGB2Bs1jv{WxdjjLxwp^+uKr6{X2>Q(a5{1vc=S~x@oi~S>2?mp>H3ZNTb%i^>i_3 za5X!pP;c5$R4_8E@Vg~T6x_EG%#k9zvRWImLMS@ujFph@94RpgnM^(tH~Eo^P3B*N zaQR_aBT1|aSL9h(Zipk7OY^OGP4H6V2@X`WVl5NPBu;@p|?4y&R0QvSKEM1p;a1v8LN zH+xHO1?;bP*RW}gIyi`GU_;6)c45#+DYr9NQMPTBPeDI|h(t0}&P{^GJS!LryKlH& zbSPTw-$#8BXA#-tu-5pAGHQoo)PP*GRP+%-mN?>A8w|1#M&+vd{nKs;=clP*)xvEyuQyi}Y530nqTqZ3b+e+LG0Fz0ma2 zIstJDz8Wy<5WCzUB?HYs^}n@>D3Hy&*h&FLTQ-+}SE$UR+WG>w8_I$6MmSlR8=xWA zrj0x}u5`b^itSZFKJN=$=Ae>JA$lFbzu4*_U^Geu&75L@uYi&; zbjZ1B6evoB0lt1#WW%6Cev1ge_Qhuwvui+-8fH3Va#twl3@{W;$`tFx5VTzNG7RPp zz7~Ne6!bfJV~BKjaen#0V#xa-2!uo*S)OY-%e#eH{s5eWG$AQZNDHSA=7cYVk#dGD zke#mQrGCvX&VY*hL^4918Eu%pIt3i^zSdMC+?&$aHjD#6TFA6Q^)I2vRqTS-XqA3? z?_<>(o`cI3E`qkuY`%5&7O|sH{r%irKRc++j-F+(Lhc0znNywIJUT2Tptt^KA=dJV zh^G%hS4+@1L-0m0Q3FMw8qDrFMMDfDWuhI%r=dZIt3}+cCnhuCcB3T$NmwoBT@s8A zb4i`>Xd0*4GNy;NP_&2{r&tT`AW@aiEBX_V(UD8cD*CqyC<+)=#0IBFP%DWF)gLpo z)4UIAV41hJCtm63H_?zmn=hNtJAw_GV~lR$5y_%ym-Yib#}=D21{CK7y{pI`*NQ^P zY$-|`-Z53dk5$_A-g@XZ3AbKg#ZTBLNx}jnAEjW!W6@f!lU&hTENT6UgaiaCCP^(! z<`|!%zQ0hj`#JAtDFj$EBM{QBil}L|A0oDhgsz35R-%GrjqKo|XsX%(dt#`bh=nLi zffSQbkszKQR5`Ih`yFSJfUaQ65ir`Q`69GAtZ>l_CZg;~s7_nDPpui{)rPm3L&_5ip z-?>}N1e&q$(vA=dHQx*ADq5jiLVp}_#f76mFa%=H2KNjFgc%vm43RKk^qwe2uCfCP zWrKV+8!S(k9QX(n9XQMik)|4-F4mOLQiJf5k(DOY6%hb+khYwJOyuXlEm9;4jaeCs zkHDmyibw}U0H#nhQKU5#N;o!I;qMMm>I!~BaH(Jr^QcN50nyvADx^f<35&nFNNK&~ z7$o&9q;5V5E~^G)r;yEw5e?lfnSWl4XH*CkzyQlZp!UP)pm81!l5&FF$RukeM$|Z( zkU#m}oSlPIC0NNQWF-WpB3LgGIZQl}G8br@#H18O8*MVM;UH-Oj(0z*RbJ0S=8!y3 z8~5}df(c@*_Bag|L>Rq%+$tdlSIFb_K%-hwW#5=qokT1~Y8DU@LwyJ^<8v zF-mYs$w=jR&{f!6L9(zcKz~2<%j>>69Zy1(kHQXu#Dpx(G+u}(DP*BsWi2BHE>G&9 zO@0CS9TPb}s<4JInam**d_dSU7wy{Q!s9AscZff#QAWLN%Lu*FmMK#tL+T3M5xRkB z85L9tGM4F76c9&9gbBOJBy8MZDPhue6t}t}YCf~VU`hK;rxSSW8Yq*wrf_&F-6LWQ ze?SZmxX*-a#S8vss;FlaHgoVb&JYNqr6F`DXsA;m4R!(x$oEI4pm6>Px+&?>pja&s z&79uDfk!i4qbEJAkvyfuQGudS17$9$RY*NuuJEyHa#WKB^@^X098m4rID@Ui6L%XC%aE z#g5>lNSi%?7ZUPFz%(;=1Q8=wEcqXVw5*HVf--^wko(s~Yo>IFjZG8FB7KV@$foyf z7EGujfduq|?7fygF@ua%fkoY#q4 zaH5Lmt7);SXz55StwC)tEl-;@ftJ4~59CThNGO+K^x6U>k5IW9jDpn+_!{hEWE14{ z#P`c+qH?c8ZdH;AT)m(xZ&jM2ikO1T`8h4OBj~LHO0MzZToONKusSEVQ~xrUbt}h-~DhIzR5*`vq z@3?t4Jm?xO1)WFde66c|k_PD?*j978w6=`3QNb)sOU$i%7`01<80a!=XS`S}%TELA zubwrI*9#Ocz%*@YVlcgY&!00m?K4=zVxD1Y#;OqUVhy`8D*)_dfX@yZaO7%T+M|p9 zDt)+<_&dHFp!wKcPNXvRz;v-7L+>v+W$YE-xW`u|Mfk8}&zDW9y=tRHV;NsOXM}If zL>;a;&&o@Os7lWa43FJNSz+?Z29jiKhK843SIV zD}o?$&GEiQW~2{CBlb7+@%LnP+Qj;vzx8Xm-I-lmej95&XM$`NZo-KZOQ!Sj@`(x2 z`lo5wUS5K?%pAGd*k#Z>KR|((#JsCY#yeqsT$fMpxVEz|g zf4|ZD-P#`4DCx7^>gVhoUbr217#y2=J_M6>g|UxWPR|wHj<_ZmE3G*3$YD{m2|GV)uDQ|CQ{e_XyXp^xM2*ZX34AT{V4-ltv^kO@%j@cC#D|=yRwS4krQBB zuXG$D)I=Sc5>{T3@j<0fRPrpA^gM)Gv}$si7Ha| zE_U(o5}>5}m6aOm&Q$cr*Um&_uH?vUZemNWCI3wyI`^p=vUzC|diZ9mYMJ@Ctg~Oo zC(y%}XWg@Cu7A6X=_1h|(V2?*qQsBHL;N9S9mDHOm7}~8sdl=K*RX6(6jCJ48nzVK zViP(P80uW?lVLLdvPraT`YWe~;+ZwcR^jNB(lt6_SFZ(SM*Uw7{UYpeTd`t;iy8c0&d}(54zGnMpbYg%uS#y9Sl3QL_H1vd z2;bi1U-8mZbwZiR4m?$U+~B2Xb#0eV@hg^TSpCst zjW1)RA};=3B)hMX{i|oaRMB5&w@``j<%72L=m@XbEZ5`l zT2HYbqz88QNQVsN1LOg%ZEc1-<^6L97$4)2%EDJyM70>kXSqstOjpi;q9Rgf_%)LY z$}L7dyQmCaeYR5FGc_p z1XVFV=MGaU@RoH9J@ysT%8asV&S)0xPn$f!VgG3hat(TgSrsvrw33v9>7KGq_};+C z?Y#9L4Q);%Il)r1}^Au>%N1dwneWcS3dY zckzs95htNcr#2|GSgBhOB0aZ;X9l1CbtzJ8r&3<5Ny3a$?_Amv(U!4YtuJEv!3#XU zCm#cU4$haXw`g8w*Qzj&4-z&8+f?(u`|s}_WV2fuY2dbwgbEkO4jpT}f}qyF1Tn$D z_9OeCXWLAF^eRviBGCG!G)qfYx+;iC!yE>$bXAw0{mgF-Z24cbyX#8+2lhE{`E|#Q z-S^yAoxk2x7G4%hHt~!d_s%wq8vlQpp7QN7C3XRZ>Kp47eEE@U+y1h!0ciG51%ejE zA2Fi6Oh(=*gZWDbuT^PRzyHa21NWh% z!2UN6W?s;`fy{rj4m603$N$7SW9N<`H(3&{wxAWtE-bXpL3L{kv7kSAS1*1z=KR8~ zh8Ko=^VXaT5!K=uEMeLa1#a7Ueb=08o1da*r}i!3*g#OF^r%z|-5Tl%^-_?2A#nze z36zM)eHU`eROvqk=k@>F;OOIm0+j6VY2KL(fxQZwI`B$h)1;$b3s3Sh0+6nqy_k2Iy z)5D;3f1CwOfPN}HP@KA#D9H%IX=6GYZxg)PQf1F^>GaMo(}62j*$x&giT&_ysBO+c z446NsdC7tU7d-!zi`)*PGV0hGd2YvI*=0IJ;VahJvSP{rhSEBl#T>e>5gY0P&@6_u#u_T=;nU3H$7Ku*fO0qw2zeC9j=un^DVu)vP@y zrQ5W&-xvEM(X5q?OqwwP-<*U+#u+Y}h7HZmW=Wq|WmLAN3@AX*!mrJR9`1@mR$6xL z24jHU`iY3VQJTR&<+85oHZYY7?@TeY1LY}0FV#~}5#M7FKGV#6iBkPj!Pf>9%9)F> zaQ$nLpM(b0`cR?3vY8q`*TSrwp&6FMf^0=-W9uMTc4+vDhja3h(#l9O>O4a5-X?F z!D{meR^ug7W~OH^+2*ppOrl*i$AFSnrDlO~1Vd`h)tcwRVcnU=HNmSqik`z@Z;sPE zUdVe4=u~^UyXX^qS(k3QF(1%sz0YMBdgNpI%yfcy)V7QjRnjFm@uv#PH_Ec6g9W0H zc1a6?uI%egN?dKtRJN#(!O%wE24EEnV3bVkN5LTNKyF66G!uY$=T8dHSm3!&Vv2+j z1zi_Kk{=9v2eAdUCtnv|_60gruo_VLe-^Wnu%jy=P~Y_qoL54KcRP$;IKA&S^0#@5 z(t_Z`YW_cX3t_A_-GA8@s$9Awn3&5wsKtoHzvp@`BUh4uf)l&P5RtnxJSHgMLJP?v zyAOvGkb4Ye19#5B0U6lw&*6u#@B4N?xAfJkY-|_Wi5zW2RJ&^*tuDoJv(u`)Gd9L3 zWq7n5JN9>mC&b+02RaAfbj$P%>~5P=`*bnfqfr4l8}1xhw9GgN-*nD%*OER9ACrKA z5u$c59tKX&cMTkrOUeN}q4_)U;k7^GI3}OaAPu$=;;Non-`O&|-TC1lNBW|~Lz~JV zB(UJMZ3pyZSFyaY*+|jI%8E5m?hs%xF`|Sp9!Pl~TV~2{i9Rx{q?XU93P7H?k9(3ehSYoJkpL))B;#TiJz0gt%TF%Q zzVL{X<^lEH*mrNx<#6be&g+)y4r?_5xXbYSp8ql_1R{Q-Sw~~$IB*@G%k%g`M(BFN zQB^&0s(_P3opkc@19?MP;)oDh8zehoC_&m0Vrfs+#RE4~IKiLI=IKwl>}^*aVtoGY z5lb8?*mC+IpLP_)8kl(;YILaoLz|F8HJp>KTlgXP>e2T_v$6Skh1sv-2MzR3KbJ8x zLx9O>gg!smL_=cBwDSB9SpuLXa~0dNp?yH>LYXBOL(_L@l}r+i^tWMfE{6afnegil zUB@iVZh8f-*O(_2Xky~`2zl#54q8fnRKm|$-X4QwAgIhaJE&9y$FZAr2h8*e5r2+AfsyDfx!YgCcQ?3B) zyi{mfp3fb9waioegd+R-m)R456J?N5ccW6F`&x|DSYNLx?f>OTD2$yOk@a0TkH-b< zM^JjW+fSRexQ!_$UG7$5j_GfA%K&@-NLSj(JlAM1_zoZ**J(75nbXJ#z1Iv_l+89u z_$tSYy3b>|jjlMT`QJRd@@31CGdvBTF=PoVV;KLVWg;68z}G2Y8BETmK0E<+GN?@a)~Y4p12jX?Am0 z0sQcO^cULb@yLhV-h00G=jxo5|j1 zJdk$OwZ`xNW$hk;cejhM{NtIb2lZ4qnax@h}gW_e$DBZiqz9~f83fM@pa37p8)g`s?c)TE zgd2FbARBadH|5qY?ov_aPhN6eFvXSzQ;ZCCCb?|;(t>Lz=0#$F^88FYBn5QfRuUVp4o^MY!nU`FulBd}U0=^Xw7Lp}vt8XoHIy&RP}pSR2h1@u z8Wn82Glp^nrA4n*dFN<(a^hk1H>>p$IW;bhJvg-))gGMSiMv)X1I(KN2 z4d$*#*SlUZzf>vq!N_%bX5p1yQy5|N6Tsa*Jk-8S7>;)@erueRO|rp?@)aHG`ZuJN zhO~A{+p)$!@}acf^5aaL6Y1S&e;MG=%hB0p{$YF?#NlQBffKxLpUPIho89MUT^UH| z&swuf?E<^TR0toBmBY0y&Y&rgSb5YcD+Y0KL z^N2@68PF9k+M^kgrRX>`RNNCeVA!*m5gy@0tnT4v6i#%Uf?`zKG$#%q&M&yZ_X&rO z6+RC=R38socJJN_zl}$)YJaYAxTp7Bp_qbte>97af>LGddDa_EV z47XQYnNL`Wd@f!;mkIh?tM3P16?D?E%_ z|9{{JQQn4A(&d8wC*-UXZ#3MFhJepukt6YA3@rDaC}uBdyWi9pLy_ zpg>Q@mRQ(oeag-JVx7t?9kW&lsrJaMI#jI4&X}84X46go6OyuekR0#n+@5vptPqcX zl*Pm8v;NS_>$CnbCvKPD7NjnN+iUTH|5m3o_BKBYjzS|6FrijrAAWu_&>f|d#WQSy z##z!^H2(leFEFtxs=owD@4$B1uDW#+^wh5zoA^=-N8i(mSTS2Gp|>#iu(oGXF_D z&}kJiiv0w|-rrrBH6pS#tOF009Yk9(`9)lnQE2w-{am`C;by}nmSz7p*>ItV1Mt7e zhDqN4mJNQ+|L?Nl$o@aF;k`B5bTzuB(eI&E><(S?y2s4$kNSU457Ozi1q2t~@C++oTsWl*WA2qhfrlu-@$t{L$SjOwTg+B9D9 z-lagLBFMQuf9Kq|S+l63<3g0r_owW}!E5309a}^nBuw*6KbP`*cXoPT_U(>wnut;D zB6&S*Ns^HsYISPBw87q$#z+z@AJJOpfk2bbvM#+GL9+giVU1)cJlC~ZN`S2L8fW>( zjs~GQCvvKdb@l zf3b%5g#TaGfcxL9q0M{%ylZY~oNeFH&B9q)ZeGaSrMu%B5OeaVHF1szb5(e$t1?l^ zCts;<#irhpMESRh*yLx0?2&#(Zr56+dXV~VsV3paH&1ySk9Hni1cO4*tdrLhk>(fC z30}QbmiP0WiQ+JH7tF!AE*Z)f$P-%g+B8@CC(`B!Kf{^o96(2CxeR7-wRT2)M`o{r z8m3_6J*N}O9ZCVu^M&C58*7*p_+bsXPXBewUX*~>9I=ivM+l9vQbSX;@uSYd>JvWm=jilgmgX0!&Bvj3@yacK1-s5*R%;PVlt=Ez5Xll2rT zY;9c-X7h(#LT8w+`*l46<^Gpz2pBP90daBQ7)_%Jn|I) zQ2O1faB(lWNDY2phiJJ;GBqQm*^I|f?ulMVf&KZLY5LFVP+Jp3c#7bge5#0YLs0mW zL*v#Em*9!Ge*02~_}v_xd~a}*IFzwuiX682VZ}NV@bWb1eb+6SL6d@NJye?XkyD1j zKx8B{F8%HEwAIvBMJ)OEs~hnh|Hgsbe-DIKI&nkEV*uL&0!IoX03a%2!BX2#AR#u; zI@}mIx8pD@ZToAuP4$rXT)-%%ux;3j$1qi4vuTvv3WUVS=~0RcXoe3j_{@?E9836Bgoy$-O2P*;E^c9;HHp2TjqGx z>Wv3q?tQcJqDZd(%8`Xl$@i1338TY$0HFJWTm$nsz$*Ru2r?&7KOE&UD{45XuYHeO zltQmahT)wEU;aWZS05i`QvUABeC7AOTPnA(EST-^NyGu6=*j!QqF~-PdSLevVlLlW zZY1!gy`Gv`mE{9Ummc4!DDNt4FZxsCSJ}Ck58HIGsGpp;q!?C@44bl>sYM%Q+l-b?w0_;p#2Qvtv}K2m%-gxG2XYbY5M;qe zk;9Zr#im}%VcBzGQ!%4`#;}Mr)_Box+OiE1C{1Oc(Sq-=VTCc^>|wyEd_N%t_s^l(f02V{*Im4^lF z4(@W1?k~QR9=nek4UqBBvLzT0+E(ZgKtzPAeszEf@`sf3DQE%o!PARV3%<;=@~H?S z75fK=RO)C>fX*;{iJVx4tpL+L%cfow_gdL%>VYv9Z0AQQVf<+12*c`6nj-MoBg8`V zS1&TdXOa>rc?YhuNBK9GZP3k66cK<}^RdkKvCOwIkn}JGj-fYApV;5$vN)bbGC+;+ z0R)s)9-P5Sidls=Y*SzbW|YPK1r_y0;~kRJ@mZ!8Nb@Eon&~3GvoKTQW^YjBB|VL4 zSBk_gd!3L9Rx&KPLu`b{3Im=v4$1Q{~N0gA~S z>Y%B4OZRjjBx{D%pu3`%$Lgtn8YeQL1mj3rYR&+rZ~%Pc4g02r1GJG+_BW9NG03Vs zFj_YUdRGF>Q|0co#vP04F2tV_PPDo+UBsEEs>D($L_cY;DLfaX8T%HAM3A+#`z*CtDi+ z<-e5w6cjXAUilSRc*6>h`4}AAOrpr`wdg3cDsz_B-gSF&A+yNK=ybo!f`8ogD!GI& zQ;%FUE!#M`?A4X_E;*yd*08Or?r=u8CDXqCr}3~csD>Qzq)=AZ+|@db;-UJ2PIoWf-De3 zh5^&L+&lf<>urTaH3u9Yt^(Ekp1_=AX4fbEk*@*|6T{ToK>j(k z*u))ivor-?PchA6V`cNAR+M|{kbb#^2#DF7AX$0X+x@y&p=f?!Zz-Ag9=Z1%nLUW3 z$}`BPgN?{q;Teh}tJqpuGnIK{hDype($crqr-n?8O2VU$HF13Eg^e}@8LRSH(juta z6usOJkY-vVsxQ&&iLO-tKJxI21SMsS>=BrICG=VFK6mJa z+2a)ccb#P22A*WcApwTlM24|Lssl&v&VF+SzKNGP^hnh`RQ=5oF6f1dPTq%${>bBq zy!#yzTmYhi`XH@GB>T1O!5x?tbbHlGBok$@Yj8M6fgPC;_7(0}6Q!D_3ShFhfb+!d za_tt8?r|hbTJZ89p>1DuWXE+sX>|EI@_Qa`WYK+OO*3_0-E7sEiJy1usA0FU=H(zD ztnGMhLl!48`!R%89_{pu}o&TtdYCag;j_vQX5PHx1q4`FJIzJ)$ zjOabR`tCpzpzQr9){b2TGj*t#w>mq<)yJLCPGJQ8t>(5vHH5Nm`OD|nDuKu03IvF= z)B4Pkt@))EaBY*cL$k`WJabjw*oVt0&AJs6t+P1qYQN zM%M=}bjg$iy5TwLvKNQD8`G%w8{xE0NZ=2p)<8?uz9{1MiBMm?U+lf*ty^a^NxC!Zy>r&-kQFXlHh==guujM$S|; z_-A!@cW!5Eu1Oc(xY~c`!;bDbDgwPVWveow#fi3{dXx;RmGv908~OEe+o*jI*62 zoIWAD{L38Qtp&!Z!lPo>fDsm!({IkP*gJ~?!sGjVcJGHQjQdind$QP8@?x5YhG&mP z-PG5@4A_vhg9*1QaV@Q}kxfsIsqDk3!`CraN3Ltr&0{seK6Sr^&TgFNl6f6XQzd-# zyUD4Nf>(~5Nia1Z@=mG3HQZy(&kEg!8&+bs1ZyUK>=^fk>esNHeev`(OOHWT<({NM z&9tn?2V~#}6Vjgr8^3VO*2=7@lbm))ha}j*` zc=1@xt&EuahDv_925@|xIofEwgI|};k>4^23y7%eXN%d(AFX;hPF5B0Jd(_fs}HU$ z*iYl@U5j{Ml6u+LnVQ?OK6q5TQTAUlo1+c-DN^zSEAZ^w#YiqD&Xg37h7|`W8%A^4 zLsD{m)Fe+@39UE$*~!bI@x#0yo*CBFnOm*D>K=A7_?U7Y!2|Bz%<3xBV2=_`%`5d5 zZt)_eB~3GPqKn-exGsh`d87QH)Ev3)PwzeXCQInWf0<;dxmU~S+3}sjQz50!&)VIT z@I^J+IPapPyYxQSEn});A0^Rzf^u5KBLz0I@W!#DJGwra57j#I}`QeEg<4l1zC zqx%-%8(sf^YXR8z&u-q)*_hc+@buvAy-`e{fr?t8P zgsRwHH4%`LU=c8$tl5-Nhc%~e9XJ3GorhyMV;bDTF z_|vvLk`A7$OR!IZd=QqujV+`MpCqsfTJ^G_7(JpL54)x)?%|Fc|aTYcJ(PSVtbYj&CMimkM@<920! znq`}p`S-q_oyz2xntLi@K*eX;;}5y|T0x4WGcwa8{v^us{m!()>ffqt5m!^?45${( zF^HKzGT59K#!VDTs>v^^R7=#5 z(Tg^9*{r5?cUjTeq@^jTH?O*J8xw~+sa>Y^aY*fE^l>&H(R36yg48RmdkMe5x6~|E ze7s+@0)q&2oL8ctwcz#e?HnG@J{=l#J9|z){Cg2bn&9_5Sb(Ad?PQi^?>DU=*FU@b z@$%57J~}UiRS>S_6%{R?6_mbM{#!l0#TehqNp&4F|1?g$Ya zSC3r^H_T@~9a7)e*a|hW@U%ibReCKl_}OBHos7~Q;!Wqsf@-$3Mr~De+Jbi4ye$yx zXxx_|waw}cAg?o}{<0fT$t`6DXzOd`lqPI&I;Kq~L@hD~Xici$j%SUkkhH^%s>ra} zjfWzsH|7&z44kvcz`F!_qSu1I_&sQg5#NB`c0+9VJs;Nm>9zToOlZlU=M(cXH$(%N z>C{X{Sd1&&gr~A!yI1b)PfZvmhG=1J!-3%n9@mE!&sr>1t8rAT zZEaO@mW41&SiQ_Ec>Z_NbkUKdTR#E)gs@%m<1Aog2I4xE2AgZP|f4wPE-hrmr+%M`O8~HAy{Wb^Ku&nta zP^jp73Mi|bo{Nbza7y-3nJjMrJ1|tqVkJzAIirC<1SxO$5VkA1(~`$pTR5jOPMRq_ zh9Dt3LK%!fqL7dw^A6}mHDRhd0A@=Z8%#z!$(134^8f@IH#YhORVq(*Ke9~go2_=k&;gn04GJmF^43Viue*TB8N^Tk4QtPu8db+Wb6g|$uXlKrg+^ z6}qu#wJzg8s^RyuWYSWqh7(J6l>`)vHK7k<7PZA1kG++WPGQ^R(Wi!#A4`;5PjVmb zlxBJg>#!9|Rht|05`FaK+GQmLPMRv0c21A>=NgD}O$~ilvA5&G@YZ3_?`y@5kD>=M z@tE~P#<3%p%ezw-EpZ?7lnIas`L#nv{YrZN#4as+9V@q{)(vllN`C8bBgkQl@bZWmPLHYPY}QElXq~$x|5jCz|s@=EAEb7j4<s0JK9ZTqJF9_1vD3LDWW#+m=qIAI) zb}CipfmeJiVv~}Zt;A^=1|G;mURFr}%P-7355QAERaQUaU8j>GuC?|eb{K>{!)_VK zN4!lTumRIUcC!Z4GVIqNX%ju98?o>1wlOhOu36Rn7RIqym{7ZTy%g`#MH$M|ut6Ek z-k_FG5}($DCmLsxd_MSUoO}+VXq>!0SoAsu8b z^^_~jfN|ar3DT$-oHV~*=3CO(KWz)y*C)*;L8zUqX5Z4%4vv%9sN8oB7aqw46cCjLmTcSMOY3dGy` zhtZJbg-9A2jDi^|;0YLHr3q&Sb-f_gN|-Q{DY-J10YNuNjgnmqCp!K!f^YCqq9o?= zTuGr=NHDlv$&5lG{XoEwYLcun0059;5!;*;2PQ+*90 z)bgWx2>-%0gRO7^`LhraAH+rpT1Eu=ewdI2#JFvuQpjwD@avbr1;|kY#KN%_@m^HH zOh*nR9nrr;Ia@j%?m~QCb3jYTO0Y<3b=eTil4d|3fhxc*yyujU-YFU9>yNMX9$rnW z)#%ihC!ntn)6w6`XFxU8bb2&&woM5&2MK1jv=_tkBjYCNK#g}2IuGq#R1WQHoo%0& zE%5wS%PrE?%eXksSGqLKL+tH3Th!%pCk{Qf$%b$hNi|^{!Lg>g z1RyM>fe5{I#8N7o&BB%AB@jqleng=lC=wsAQwJC!3&;ks?4y^V{PeY)qx51Qu;1(e zm=OhtfdmZ1AZH4Z=AC5-tFLZ#_qwzmJ({!`L|iYJHD6x&MN0dYsMXrEJ3LN*vjW_N z2#}K0dea$F#^wW?0Pb!ygf%hHMg5)v@l?&h^Q_2;KBwG zuiu!Wv3I{%ASrc)shmD`8?bCg4GVA9n+hakB|QOA^7m{_bvw`TfKcs^_5%!PK|6=A zffD`-Uskjk5Y;t@SWlensZKG!S=q-?1ulwj-)^s@l^+w30E`W;B0#@g;4s%S;)Ykf zeiBq^ghxc8Un z11tPna7I8eG~Jp6sNgSqea7%WoER*&pBwFogFnJ@cV_5=QU}a6j?f^f)Zqk&fB7Mn zuLJ>=NOHDexe3;(5e!_B?TW76?hlE1#d)`9 z)q(^tPrZL3ANkJ+88AIYiZ%=8NZxW2{DrAACc=t%s556=2+1G%t3smn4yV%`zmk)o z%W1@s8clb^v=YrkqUI-QFF-oTI}H&QhQ^pk>fDJC0OafdI*j~SDrrNljtIWQfsZ2r zA!*!M;Ed1^3g@AMp&Yny2xU0dC-PjX1Tp$+Wlm~4=oo|Tkp9@$2F8QRV7T`3+!GF% z*<_^mt(;Nc;BnDBK*@TkG@#T0oG_lE{CpP$JL@&C9KSG>as$cP5PrCi7nO6=GoGzi z5GBsEH%+%m2yQP`1bHj57StIb82bzg6C4D49Et}9M7u}3#66B;AQWm-2oWC`9|aU9 zV9qI$YP1Tt2N=Q!9HD$_Ll;Qi6#kC&G=>m9-9HCN)Euh$4OA>F3XcwuCpD(n6j7O(Bm6xf#>j-#rxd3wJJDOk_{n5@K zIgJw;QE}EQj;c-1@t^Wy+O$|Q8XS>Fx2HR{oex2w>6>3{_&PY*jPFzly?ecd-NA|9 zzz7sI{0So-9@pnonu`_-rM{mocm(L}sR5>UZo_Ucvv>?ZF6llNVo1L`ddh=s_cEBg zHZfX;m#^>jOUdN?D!a;y*)YoztKy%@Q7FeDs`tv0cH?9T$g&-3a73oKO8$B_d7DfV z6MqXjo0c?@<_tzMdHD5d&~=%Q6~GXT@PiW@bqEn9S~G7VWLA(jkp+a4J%x-~78I&* z0V+!9TPE-%4+JUzRMAHA+;SmnyHX)XX{vG>L(E-TA(UDf33N^gM<)8DVYkTzE(*vL zsDU0X9ZL*{>+B?{eT`l6N!#_TY$lDeaT1QG#ByoQVI)(Q&TC2G(le##y1+2FnS^1r zpj|F)runQd!J}U*^rM)=z;9eL-0LQYoM%emz z?oiNVgby5;oI*rD21(+-hseF*#)ixc@KmKSwtIp3V%*)DiIE~I3<#?bGD{?43QrJq z5Xe}zXn= zD@_9DhZoZd$!s`iBES`#Izsk0RFL6Ku3EalA@sbK1dK6UA{Zf|)fj;>4EX_rkqwNz zHdN3KC>#T1on+54(VwY@ITRF(5%bqIo^T`@ef-OSQ0Ek3HP{mxh!G){<$RhraBcf*Kx~WEz7i9uyOJLG`g2jlm)-Aq8t_|66)w zWisY1-?BEN*$6emQjHo@g)l$ZR48#HJIW1oC_5#T6#xlE16WK^Lq~Fuej$6bQj&oR zNJf*}IHrW1tZ)b*MbP}L^re8&f_Nn$yrG)gdVc~EV z;X7UUu<{m=u_7#!#+fS86q2nZM0-SiU&O{d{f__%`{vL;M-|#ocNktC#_CgtRC{>P z04RM6S^*?Rx>3QU(x;b9QMMGSzg*+QeNppg0U!4PDMp1))KkiQ%sxk(vhHq1qSdYG^Txtnu{~M3lA-2^48_jABXS z@lA5=Y4J>V>S%M!VoBHd7jmK6ieL7@+Y^6BX7MTnY4M-rj=2WETq_6hC|@jFFkR|- zA%OCoy@Jc?c|-Nb%DJNfja+;%1d?~G|3WO@xvCLw?YC$%VI5DFnXyebB+0sa0Et@P zeTCF5fBc0~oNGCSv+i}exm_tS{}&9w0SHs9kk5>8sDUzmLV)20=Pd)R zKCr6BL;%_9b^|oV#HM`r5PJ4&9i4-0_YoQ?=?efX!nnc4c7MSOFkrYW{39@`o+|&k zWDi3$tc18ac7@*XMx&4h|MiHxD{7g+sPr3645G3{=T*+qgbZ--)s-)4)e0)@|jF*chD(gd-zRw`a2$7v2g}ss1@@;EZmAH9O7)Rf-)SJZUWZd8go^OIQOu~ z^L%7n;9Jb%b~h~cfDNA|P|cPfV!qx&g7lCFalYA2LUK_2m+@~W9(5M|*f{G`s!DP* z5X1A|_MjhigD!&cFkqlIwR}}nXK40!^8U4YysHEzm=;Ge*=b7Cld^8X^HWo|;KqaQ z0sU0ks_^J_UtFTt`+K3*JzBeKAbX~MgWMO@V_FOBC0-7yD__R;rsqDzT5Np=mShEu z7AR8>x&?|{W9F86c|1%wdYT4gP{=drNnI}Y^xLOlU z2Ca09m-BeYcQDEiCUZzT=yjyn=8B1%JcaIA{R213x&l7L{A>^-kVbGF_Cd*cMJ6oU zUEo1d%MVR^T}5Z5RO|^UJoFY|fzr#97!VB4eC6oR*lslt3(nezLd__VOgu~@hE5yN ze6J6Y=znR#0Tc_V{N5uS@*Q4gp$5#$AIq0%q_um1=;M}) zd7;zr@C&UXu}x|CMDO+DkO#%Y^_O9NZ(a`XO0iUzH#5ihAtgIcGpL}f1yfDdH50#p zIoDB;y4fypmtSgHTo;mi^F~3d=DNh~Q2{Z@kA*jsjQkZ1bTE;HU7DpOnCq!C#Z!Ov z<4vcI{}$Mc{4JxnLv=;Xn`Zxe63m!-O^!J9yBCOB^4Z;Hk8IeQ&~%DP988z8^9r2e z2?AK2HU<^oGK^(7&=65V)zlSf!a!#S=cFXZf)%!)SYANE*eSR3Q$^=+3vc&AJ~p0dJ3^SCR`Gy)oZ zlNADNt)SX%Xq7=)jq`>i_uk^+^Iv<1s>xiAe;v5s;}LEAejmtE8Odld#8P;9rosn= zJxV_!Ri^F)H-#m4q}ZOQy-v8KSB&DnU?mobP>*g(L~eO71KYq`4If1~lb= z!Q3=(fU1_}smU;br?;f!5*B0EAx40r=maCPs8)%|3n^FAw-vocNg*Jss+MyVlVd9y zJIq``bP52nPRXq9X47ODqd>3tKfD#g*&}#L3!s#57la_mKlETXnMH-^^H#iRf zYV>%m!OvqMA=PCbZnQl>MQkiMvoe!);S#^kUj?m(Xoj@E33?>G$uK%HOQ8ZAK?g-7 zKdLP7hD1QMFa%GGtO*T&(lhxLz>~1FOfe{kVT(+}#ul`oz&0mF6H?|rCbw`E-qKtv z$>?v7jtR-o8*Oq9phnc$Sxd?( zIHC%8NkSXrtU=}Yy%eKs3=(ER5F*u7PK%HU%g_#hY;J!Od5yQkfqvF4}7frs1C)ix|%pP>`m(NC+>AG1{bt7xhS6 z_K2=lQP4P1bAl?I=%PdDr{x=o8s`WaDEJ=K;WyGws7Oh{&Jbu8%$tz`1l;0iPy;e( zeB!k!ts7Ii%|i>~%4SfJg%wJ_6z$;m&2ds#Ctd($;sh;e-8 zWW^SkMO6$DK*fnjU^5faJwGjM!nH|UDv&0#SZwpFE!1~xn6cqggn48S84#qI( zO)d}*s!cZ%c}mef0*~4nC0#9AwxjU~C^(WAN%2KX1@-}f!XBf3{X+yP<{$?_LRf8j zUgm1AKGN}EkCrU#gvy9Hjje&Uw@|qjwG%6zP(N5SRmC$t3}2;T$4|(x9Q}JnS3LM> zWQikx9EN9jz^lR%KfPfDq(prRlvC3fl}rlDdggi$Lc(?$Mqw`#D@zZ#rbGyFS(5}TX} zIXmDWoY55}vSnt(m;o~}W2j75$13#Mg>yg!%8H9$PBcE zQKRHzI}4?h(GwHW?(v)Hwc35>HH_WN{5u|=6B>bP7{n!djmP8Ah9xGC$|kT){I(On ztcs`hDpbZ2divwcfKr$fxm>wS&9WbBq42QiAQ}Mz?qu%tu#M(8Kh%7o&9RM-Q&vDF zFq~5$`7KKfbpW;ijr(IqI)gTe76#HTRou+fCo~NXUln+n!o({%!RaZ53UAB zfcx*X2H0g|`OAG9YAu^V|A#_lT(wORVQhakDSdEkkbjMGq~O&ac?L68RtDBCKhQ+R zT`3V@bRPR?L=~Kl*N7=E_5_HjsO`p)gYRr$w7&9tzn36r*edJ}2dKbf49*M&1!~gl z^bJG7rNuL|CiHTY*AIHl2<(96<{n%+BcN1rp)sZt9c)nWn~WT-jv;97t`F*hPEF2j z1LHGL7Y#Ii=Miaw>ow?l3=vx3$!;cgfX&iPsfD^fe`Mg-h82o{Y3@^4syrV^m$CpX z!WII5(OD$^Fx8bM3}A#C;NDMO?mWfS=mT$Vwj#l8AHKq{og1 zXT|fL5!R=V+buq2UjMzbR3lB~Clz8}f492J3nL3OxjLl25-K_-4>ls$uD$I~nGEk0 zB3b{VWiVISty_l zp5k#}aEU-!Wbyh=($ZlT;9(sh+vDKFhl+j3wII)$2}C^==aMbq{Be2`yWYOt)H>-DKLqVW2p%u#I8OfWZH_P8c6KH_0|^A!J390QX*44D-$gzD0~Gk5 zV=+oI@fnzYd$=%1*k)1Z63|@<4pAUObtiz;d(nr2)ro4b;Envv4ZwN-WSz(QokQz| z)plhn&~-U=@JGZI{`-|~RRD>u)zRn2rbFj>1*_`v`st|Ms5N_7f`Zf0*W2{er_s{I zVdAI{QCq9`myi5H{FFPxOPlM=%Q#e9>-x+1=_&q{_fh*3VWEQa)(h_qlwarRc}LXc zmQB<0)!m^Eoy=Zpd1wFE3oqw>cV~BUvT5i0`o-<(d;iu`W@r6L|54lVszYa67ySY2 zxNhp%ViWVD*TZAxZzoU3`l^n}Eo)^kt9*H$ZYpv^&u!PO-?VI!;vVffo!;$Qu{IHP z9XePk*~v_E5BHk_v|$>?Yv@O5> zx7rooT`A}l*SpF`c@x;Alo?QBoL*=BzSS7fD|Op4s?haOSfBE}<{Q1nXmbm7P?@1K(|ROQ|Z%=DUFzjfGUeJkEe9GF1#5A*0X0 zf-wm*TTODWHcnk#+p2A=E7c26XK&?aBjDn?>-uDKaJLR^wN+OqCGKV9fydp&+kuNb zGntNqXCzShj}=x^EIuxt_uY>E&DW%dIyW433Hqiv(fi%Y!{Up9=T*@S80*uc;O!e! z=-c*Cg-ps(vvBdx+g4vS%PUjW$Z;g$NbGGL+U`}}b1hodbx$C0eDQIsI`X0H*x>s@ ztVT5=<%?&YHQp8^!8fc}#HVhW7-PH+%sTJ-t}gYe=JGmh7!12BgH{gR>M?E0gO*I^$z5J@RAIpo%=9tM{6fc$)_!mB^+SN($ zN;dKDlzg9n<QW}k`7&^7f*DLNIG!Q=}qHvYkAym1&5uZN+q8X zMJa<8KgZ><*NB;dE$uqDijIorJ9W0TmSsW{>(`#Yya_aJUmiS#%{5)ywx+wZv_Bf- zJexPSth&A)*Eyr#*b#P@J+;3-%=_k=g-09ABVX+f?N2kMY7xl$NP}c^nbCh+MYA@L z^zx0|JHO9bozYJhDmyaV{N8!mzIHyr#BUWJ$)YC-I;)JXh;7VwvL1j_Cl?1U&W^3; z9qJXZ7HYf3SlSJ7GTw3bhCTxH{63?nh*mxUKJ~SjmUi-(SO*FM=2(cGod=T#4^a0g z26S_3(AopTEocu&*|gi+=%zBg!+Vzl`L_7nn496pB5A>QY3MSE$NMJkIt#_aIWteR zXU>!=th=UO^IN?t1BC0Fqn{Tau^)Y#i(}$nvE-U}>J}FAte%0i+h(m>D zdiTp(P^m9+pu03={fPQG8?4-kzqoFWW8@s-THDs4O?M<+siB3rtta>=ue-YGigW#S z-03u8+uiBw_!Gqf^$M%J{19yJ#^Oqs)tD|sB!qGQ^KEc(&$<=b)%Rxo!b3d@$$8^& zJs%3`OKq{%mTnAFZiFR#;H#E78h3~1M?YOblxxomL0OB@D$y<0r=HJSzl_xZ7*~wz5mtUVoVC^0jT% z&a!38e40FVQcr-2WH@!{+(4&RYX%;?b{(%4MY+`dncbMvy`oGlifD)+>q^@~%FLVK zdP3y<(y9CmE^){9-{T@|;-dH*QZ*}!#LFb$eB-ytmRt?eyB^cD=;!87AF5z@(J@812xZNpUc=Lr}5Z+R(Hvb3VOfzj`Q6e5n`_bEVIC zI85|<&)c3Pzl#j)Kg8k=`)Xj3nu}1ut#umAqt9N$M{rPjaZ4<%4d1Jza66z(l2RL} z{w4gyoGn#9U;pyBQ`6sv$n{e58L}SOq6;$h(xI)rx+y~DK<+*KrrWLl`On1Oc@}%q zCiTp!QwLr0ef=!*)M~fWApON}tg5Oi&q_&%@@u`wjDC>6X>P0N{iw4fyi2IHckU(k zxttxK%Z~Nrv-+0$R>17L$_4HcY%BhXZb9orIS}XQE!phEdf7cv^x`!`@X3Dl^t*ny zD$U568TW8AFXR^{VOvb{yc;*pbbG$eC3e^|=jxC-PrA{x6qElRg)dG0Pq9GIWgfO> z-_kR&*6|g0yA=)(C%c)KqWaFRjxLXJ@ECjo7g&Ga3vMrR9oL1k`EsT+sIsRs@Idm9 z8zatXllh|;yR|D5V>;&q=i>a@c+m6a(!mw$Uy#?CLcL?`1V-~6Y_iX!?^Q)+S60ll z@Jkrmlma&)rU9#1FK!0SpdTvvdOiuRqWwC+>HZCD3r0645nWOwN`Y+x8)n##Zo+$( zSdfQsIAh%7n7cYoOXd9H#OIC+VdNq;^Yt zB4CBPx74ixul4q#=#nkFG%p_8Xktp^KzHpk(dWI3hoXHdShg+_WE0-SPc#c+BGcS zb+E0Rr{!2n%90*Ti?q#>4<&Ehypsuz!7Z#2mG@pmD~P|y>damKO3z6~@#!de=4JPI z6y+6ft!&DF*S$XRe+B>Z4HlCVk!my{OzG2Rhlif9!|DQ6`;*(PWvk-{K_p`;D|@%A zq-u@NnH!Ox+OK6l@xxW-o$oa$$bf2Y z>>No&lTNWXt#>~Z50BE+Ro)zdZ6pXt!(S<`#rkPCp`m*cG0puoEzf0}<5PSmSx~D+ zoCHyI1Fcj!1dUm)L^5-Tjx-}m7QEek&xP8DN@0tnt=`H|W``hlnecEf_&BghEx1=H zgav};-`K(hKI9O-P+&&FvO*D)vpz3zsnGK6K?hfcxeZI6D&?u^s+zVIvbgGLi0GV7 zeAKXm72<2Z7th~Jd`q++q2&i@S3J{0>aH2FN2dAW+iUh{Em~O@vpuDr@rTCeyXo2N zdEH8IfuH8Sr%14%3d8s$q`}qhBPDD>4P@bKC*?(GV{Jv1x~=fl!T8=c1F>qKt|!%U|&WMy~4u^!ix} z)fKcOmOl0o)bHDCZ!DY5{3bL_M&By5vXWOYT90p}WK-JL+ky_e!;`8;JpvR6QONyhpa)RqoSH0jDdoi|}>4xz`2 zH_1P3xf~N~SIT>-1#3Z`J%LBZ2|4_$TBys%^gY{!y=sYTX{rymn{ynH_;Mo7nvGEG zJxERW4R7%oq;e+8yIh~c;uioDUv+a44PW0ba z$16;$8*PSfYlKA=f?0;>l3ko;raFJzeS2H4-BBtQXqWbT*z{|Pqp;kS!r+zc6yz%P zun0(h`MOV&4_N#%j$frVXlG%YZ-zO7%+Q>q>8eShc`X{JSIRUHrxFNG@7cR_XO*C5 zI4lptczbZA#%?Xr7FI;pdf7iap2+`b$V1l#NrD#CMfX@lzG_9E**!7zayM&buqXq1 z&Q^huY~+yQ>}@&bojnxieFfD4P59Wnh%vm|!Nzp?;RgjSMZ#3xU%vHAj%w{BoH29< z3C-+}B1=iSwjxR1gYs5bt`RwNX+-Uq6hiJ+H7^F#iV)(^v7tM9@e+;usXZ zY~9Q1x!cUu=^5OZAhO2NS?|V#XPi7^cfY&y#Shs0aFu4|dV6OjIks{d$5PtXYddEk zHFZGpX4P!XQJE$IKM9?3F}^?AAqJUWUzVy8vF=yLUa_|A=f}eBsV)ve@S-K8Ad!h; z8nG91fEbE}90kcecj(gc`@Sm+@5vwOWZyR)1Lb`eSb^B;cfwi}WqRC71i_e?3Uxgv z_|4ceft5Gr_6Or*4&bAy`RF)X`@K<|K|xafTJ}G3=K+ipaew)mJ6kC_mXRMyY?sjx z$1%Bx_*W>u!O7P?VU9})=A|rbB8vT`1QS2A6X7YdS#cbA=sY~cw!;}>$5>@C!aWVf z1b97F#MXn;W!qNmN~F8~s)iL5CVOp6hR&a>Z>eQvM~N2S*(`b6V4!7`Ag zT1*dUG8xIM>ax5Hd<0%|QEB82D|d1hDj|cxNb~Ss(h?t9J~sPM83k*+_?^dC-Y&I0 zS1mI4(&X;o=?9%J?7ZWz|Cl|m@hCR;j)i%aY{s9fMaA*tYb$jw+$Uqt9@K}MUN4iF z1%cABqV@XK9h;gLyV?5(t-a|FoA;{abMrrsrWc~Q-)772nWH}J?nZyxtD2++C~U8P zGYd3;i^i&b^bP@oSg~-puYcz5+N9>b~?8)xMbH8LN6c z=`lm6!gyDB?MX&MFDGUhu1fI+ajruyHa|BI^j}))pu@1b_cQ^FECL$x9(W*O8)ARa1 z3q|0KnY@3nzoHx>-VeVH>u2;6`1y0Fjp-7dF{u_kI*z#p*;)l z!7NRlth|n2D}vC)wu;|kzdHQD3NEe_%-F5%YvP^xh5QbMwtzS25<*H)F~(bxbyA5$CMydanS?%shCo9wlz&w+SG6 zA&HM+vZU4W6J=a{$ex?5G99d=Jn@z=AMo5FxIYY@^hL&QQ}q8q*mutrtGG#)HpM_km>lsp>Sd+(h7X!{`Ck6Q*Ul4TB!x;eCpA+ zrQvMBVlTh8Y23fGfuUm<-``(e7~cJ}3|R^gcMNZQF}6sO>hm28p}p zyJKA_@^BPdEvyFJXB@iOlJl_h@Pk~ndW(*2eeex9g_OBozQ`Makn>V>PR8n3L#}iv zBv)O=D0>E7459MXdQS3N^M&l=m;B?6Wj0{4v8%qp0BaoM>zXrtaWXl(L&j9x@uIj| zIgAbKljNmA?{PSoU@pS1*dw5?f0-3YOO6Nw;uKkKgZ_qYwS6Z}3!V=Rq-gSRzhYKdr+6 zZ(ekatg)`0mjSW#WRZ;filSN>sMK=@!kW}pR%R%e{Od7R(F8b*gPX`}KFAi!XeQ4X zNNKXn?ucv31i{2M{e@0Mv*tiXMAf**XMU_-Ho(cH%OUVNe(V>mrg^SAAW>X$aNw23 z9vjtWX8&iP>>?%DRK^xWp!tCPyGN~2mG76PbINWc4MD07WWCnL+;tKA4!uUVwpOK2 zxyr$q{K4y^$b&mglD$O!GcjJ$d?rw4_hH=H)RjP_=!fQMaUN&EyGDO_*!=?z*1(g; zq$KF0hqN@|oyR0?FIhhV-6&b)q%6^yM?OxpN(l>HMjacTUkFQu~h7xTXV2y2{aC@cxFj zbMU>w)yQT(%?!MD@hawamuw~T=x}Axf2$D%eDj#MSo5t3MU!a5fI;DmajUJ^LUghD zv?ojKjoH72?&^jUBJ&wQHp7p-k&4Z!h`xCB!up4o_Qh&xy{FgLIm=T~QR{PUot8)Z z#&KN}W1Q2np-E-%*R zo%d|$xMm4&&xLMLIWCY2TL&EY>;9t-0%rp1y037yD}Gmi@$m zN~(%tl6M`{b54XMbIu`zNpr5=ApUbtwiLE=PnHwmY=7bSqY5~vF?!<!!&;umC*k0ZN$kx?Q)S7gH?K6kq6;iBTh4l@)0RH_An zit+7c$a=@IP4*r$bL3b*gKnS2#&yoD@#7<6i@qS+Nzwi zV(P9EG-b-6iacoQu1w`QeOtw@J?&IYFE;H|1|HfGYMDlIr!wACj>^K$F)u?$)?(@kN5p;`FTE_2qKWCNlF z%EyoHTf0fCLT^9P_mJ6l2|uAs&QEdU8*xk+gPpr(T3|xxVJb_YdOOD&cXlr*jJ8$M zal7%#7dd9SjRqZpwIkcCZJrQx|uIAj*_HVy0=X$uEp5{XBDcZc5& zOI3^KM5k9JLSr)FQN$CPc*qe`P26V-0n$$X{CG}1VWlj9n|C$fgPV6wIL7!U8yH3= z8u7AOO*n~AMJG1=YQyx4zzmRkrJ#faeA0cwz@HfZApiJh>_H4#JAN-j%AR@>CH9kc zo5A$;NR|QbS)6ofx zg0tLyC|{=KNKp9)W1xMDVf5kp0i30Xm~c`vfaKmDFPO0cRyAlke&7OJ;1t<2Zo$`# znot0sR584SsCQ=85}QPb^f!H+Ub0d@I7pmckdheEDTx|kG9$zyiJJbDKiD>kl$QqD4Y|jI(h1L?=LxtQd>ka($Min6vkoNlYbZ>C)R)y6Jfz(3y7{MEmq+f_+${@p7u`rF&5J$u$Ejb{z^d zhBjY<5a0`xfc}BYl_#`l%{5Tw6+xJbMiC&!=RdGLBNbyW_U8wrd*DXQ^BpKK@ZDfw z``Q;Qu9h8#9~zWNAO~?UYzPP&pP7xtwY^yP1YE46%nQuEIo&4Lpkk>~*=<_{ol=C_ zmr_mJfE>c{odcA&LVgIG$vN5fSUI`-dA*HsRyC}Xq?nvgxZ|xDF%{X z^SLV-SF)^yX9DlH>Jo%%^XQlS3;acp)=ETj^9eO90)PIPcWnio zffqg^bk9m!U0~!wvs$~B^fN7;?&v(Xb5{q62y>g084;kPAc-0}PDJ$Xzi13A$Rv~r z@X&>!Tk*mEDMJiUIFHiA1|eIyuR;{$6)-nrMm!xEzOk1gsm6a4Md8ZHhi3qiHfkPS z&raErQU&MmiRVpKE?M_P8nf4&hP&DqQm4i3>fBXDq4*dK2SW4cDpd>EfDTMI8aCgh z3$zI6;RH~FGul_9F^y`{YpLvE&GFTwxSDeA`8Nlhgh6eA_G%P0U{CPIw+#|&<}}+y z!EUb^x92EHp3Cu0N>Og?6cUM*^-2yV+kwPK9FF(f_h6J?y7&4;+y|*14kr7CuaXKe z(kGHC&ZZu3fla9IQ+Q8VKGw|4yPFve71YhF{1zw4olTFA;r~}plpKHw3L$QR3GNBs z064z{F;j+4ioaxI)u(;_4GvJ8Rx|o_pN`%Q20Do>3CODzBZ$Nl^rp~&mln=zyy`Kg z4*zIfO(qEmJUKR?4ZNTbG{8thhf)&Q_!kwIW`-iDZZHhTK%qyjs>dxKo3Y>IfMKr} zeb?(B6el#qWdX$yd0ZnJ%pfeLU4@*2E9DeR73{|yLQ{FK?G~f2`00RnJXBK*Y68FB zHFZQ!ujm3_QH^s4p`shjO0j4X%^61JicB1y*M=`sJDW~W_R1fT)<>g{^{9utp%@=H zL2eF)D}-VW`FB;BdY>>xoOxFoMpF+;za_US&YrI(x1y(?ujZlMxeP0uF{)&S2K|QN znqR($od6?OTBGra|aeNChcwb59Hqbm4RE9#~_$|Oy~lj2~z9FU37Mqf!R z@Aik(RRC#+doDn6qjqe=+xwaet(wV!SUkJ1T(Ou-mta29MTbLjMtQ*;Ss?^}TEs>e zNx|Ga=z@egWI9K=R;XN1Ie8&Z&@!q8$WSVw=7PL2)D)C0Vxb@7K~C|3LgaS}=6{E! zDgzVjO6lLr`wK&eo-Wl(nPV_~`rey1PbdSE%cKJ4#Y)?f41ep3^uJ{>2bIwt{FF>P zzUDT!QvO+0uk6}xGiv~=pwE|_Uj$>S2o}UNCbR(HG3=QV-sy*gFr&eDH-w%*hTuyr zlU*mIZVgn^gXx{_y%xtoflg!w)#mw8A%@8cc9#?I`V5evuxR)P6dn~5f&hz;?lF=! z05^_Bj-=1MF+rILznLLCBH2?1`A9#O;rs+)zyd8qmd==I5a5pZttEhrxKpEE;}ym9 zsR8{4CJ}c0TnVvx|4&Wxd9NBGsm{aT-n;~3K z4>q11vR!Bo`S>ObNRK9>1zBJi=57TV{S!R@YQK${DzpVr(f~O>%m|txToUq|cHoai zF*LLTjr<8to)gAjBTZZ-LP>GQ^*ub~M25#ph5@r1;&9&I1M9eZ7J9b)gqV4`teNi2 z`p2pT8%wDBotpZb&B57?3w|_C{?rIOza>fa!{mjCL(_y#DE1x|!$s)qspJLi0wpo* znlEgDfWO0t-^1gOLo?pRaqAf(&Q97468r&jJJxSB3c55VDF2A;l>8ngtThGzUu+`$ z`Nha!%=ix>ErS}f(+ndd;=uwk`R9sXsU0a~YM*y52)VF7f*(4>Qk*=xh^qkMZ*)_C z3C4~LWJOE@N+y`C(lA0k@_2n@8TRhr9BCbOxss?A(pi*zabiL$CY5g@2ir6j=XNfs z^bBiqH40iZy3TP(hPbA9gm$2s;0qA>O zd1!xeTZ$gLg1CSX z0PWv;s9y0asvbKX9RW~!+-0Oly-8w40#!nJu8!&)$&1^y0HUSG8wg?22RumB#al{9 zb>bI!NSx(8eMtQETX#tHybnQyvN+2KUY{Jv)}fVEFy)emK*WqF)37fdF?!A^b^!DUsd86q2A@UHczQeb~!Sk09#5DVi$zR-^atMc5*9l(Moj zEqGbkGld$wBKojpOB1!5saqeD5zGkIAVlPG`a-9UmN2=b0UzUD6%+4cS66?KDPq3Yy*8*VRqCcd=wD4*CD#f z18U0+Ee@fdryp=xNH@}`tB_a^6T)ABK?9n}XpO6skq~7Bn+>l~p{A;GySr;^v{j8b zWGWc7RFy7El3a@6WDCJ=%!Dq0JBsjIlw1^$-?m@`kQbIi+m(^GvRk)7xRMfI$qcHY zGuG@=0e^3sgh`MEEpBtiFKG7g7)Vb83{g^;LSwK7h9(JlF^e>*3_A+nL13?@RP}i{ zh#)t0VXF2JNP1zBj_S$nK%UK)<=LQ+f006;EhZu;q{N#{?Wa>7Ol%~XvTttS`tpfX zuu)XhDL>euoK-6}Fwn-VJeFfrNfX*&igol~W>g4!JFbzd24Bcxnl^o!mKmeL7nv|h z07Yh{wpnlr6Qha_F~&&xcatGZ@*?#6N;7d11~JljdUn#~Js9jx`IXRoEjvz#k6I#3 zEGDf%iOxmP9^DMgFaZGvT^mmm*3ROMS z2vGOr>QOim;?Nh%li-vup#n+WHl$*sA{A8V;6};;uQSqo{QXKfbnGcq9Q9I0)q#@g zA`?r-9(ZGppfR};Q}60^Z+(SEB-We?rs)%((7-NLCFI`D8Z*)D}>eibA;wy&lxesy?V|( zMX32rU~e9Uf5{7|*nqsZIZ*O1g&7Al)F}Oi_9&W|8cUF6w0bbjl8FRg1IjYmJVsV2 z07+fMdYELPS11p2BQzmU$Z1MxMG&UhO}2`DLgCo7GQnFb%o@_rp-6;Ei-VrH!I%YI zCIty;)AhPtvyp{sa8@FK>!q>aaILx7Ed^O3p2vtUu9=IY*j>bkqf*<v@`$FgFXOF=Y;y6_!~dp8;9TSHP%c&EY> z{<@IVYxW;(obMv#krw&38zZY5r#MzK*Tu;uMjMcLOQ=yhZBLG{sP%^NKAphEbU%!m z5Txp-P4;u?V$8O{VM+j#gIa6UT#CA@N586)qQdBVM%5J5*-+g@yN13 z61!xohy!N9xNu8sSceRvvmA==lcD7u4@6CeQ9@~?7H-jM0rX9qGfdmKu| z|A-VUA<^$F8=*+4AFaurR40+*iWzOhW)$+D=0w|-( z=dm(EPRCJdGCR!{$&%B)4UkUN}k8m+fu#3ToqP2b_eD6lOepaT%VlKN=P;~bm?WgM5egX0hym;5&?oqV<@NebB<*{kC7^T zZ=(W2KZ&Ls$9xE^iGI_gFu_De8?Tuq=p;VIMhPGtA&_8RtfUl8`p+fZ40fXd(ktmA zVosnrkAyJ!Q&=83ghRqb36hf(@SsY2CV$pvH8@ZJ@=+_y8LeVK90avWOjNSEhqanK zr(*d6bPu}kK}449QdS0C{)5v^>|8J==dEPGhN05-T zqY=vzVH`SR-V9|rwz!Or1j91Y0NyiWQIW)$g>XT|-a{;($bCEZlEOnrtx*62on=Nq zLkj?eu2GqlifTGXfxJDSf>}kFqKH*$@tX}49AR#dM5&_PWi+OiQqU1*KC5mSMK(yl z^q#zc1n4tc82%#~ApZ^iOB0!NYc#S8mnM&+QC3>GmE+Bf00jk*j=WtuK^+)2(+QSS zJQvM|n(RROo{I%1`7n6k;Mi5+RzsiAout$W`1aUVf|X*$HQDMB5~N@Q&zpg`6TBNE zm#Wh$2|Y_ES}mifJdmzv_k|9QOrAP)gf5}CXK6%Kx)F8eKC<eL?2N~>y{woOE65JDea~ue?A@K@Qu!9sql#NSii^SJZ z-iLfC&9oYG3L{2SsmyPGXirp4|qPVfL}wY0tL-boMbQA%gqsj*%6A0Y(Ztn zkQX&7g(U&qBgPMcOo4-%A71HJujx@)D=D zPgTR2-)UPB3r!xj&27`8Q$g^v1fZ--<5~dC$CoOi`t^r_&Dv{yEBWpsH&>#J*a=>u zO$exDI$^nItsq(Db*X&LS_)V)IvR5XqA#v@TPw&i26VGtfRAG{OMIKLsQZ$;*a*l% zW)|9MV;;y{HuW8-;Hv3r4EirxD)UNblI=T7SB#i>M>7##G zjkG&sOeAY@a<`G{3)6_)yx}Hp1e!*b)HO`_pYr(BTCTtk_E-SOIG5!77Z7k%vebdy zFDyjJFg9O39r?1*)#rYMPDoH6VqWzjqQUKq+!0b8y_1+kPM99CZrBjuJDOw#Gdr8e zMr~ck{$0pz)&7Y=Z1j9lc9Eb1eOt=ySA0AQtb;%9EkMH{qN8XwZuOKxS1X{Z3i~7I zWL$QyLdmb$oNkoy9KME+QK-H zG1`&6WnT8&8c{i`BExC3SDMUtm^|K0M{Zmg75rjbx?`nVf#p}ViU8b#W+ zALhH0DTI;3q3Soy5#&ndZjR?kAAxNN8|Cvly`Z_GSa6C$LAzi zhQ&YSwfm1y2Tz4b_6-BIh_k@bd z8V~%_KlY?N>X6eG7Hz&JZ=BX?t($zIR7KA6m8ctw=;QSdf~C!(7BH^DM-mVWaF`NJ zWcbzWxg=70sm~rSGcdy+j)*--iS*ih{joZV%%niyBkMmSGk4t6ua1DJhTrR#doBin zS8D!)Vk+J)%YSI3DrkqAau{0gH_#?Q+E+<7WAdF-ZsgC}q;((9#_#gxKXj?bN;>&pWE?^%F8|3ftgoZ1VVR(ryX~`1~R=xPA)nkuC{FJXHV{q z{#fKUV_q&eT_g1Ys+PY~Dz=P`X2MbLc z&n}NQ8O*lMR&`Yy!5hz8?1W?|lIu>fDZ$#q*v&mMM7jzc20%dD`-W|Sn z1R;-f_ym`}nt$s#-Dr&7OuW78wQN<56;Y^mwg$gfJ)PwBnUY1<|0NcN4TfF5i3P{c zI-|8i%@Ny01Z&Nezx_KoKd9TWKm1qZ5c7jx)Vx`YdZ!VltP+Dq;^5I zs+&(*Pn@ck*_Im}clRq;KYh1DQ@ngWbmZ5TGOM2I=~PvHY4*3Qo7sR@-5*Ud|9E5s zpC5FvV86gWXnr?#0ta7ov20U$aTd$te|+Sr8D|(?wKSVI0Dnj+(a8QD_preW=5(g6 zHbEuqj=kh<`Ql4>Px2Nwyc4aaUTqKaL~k+uD01}hY}MY>qUA~@t2mi7aCUFkv59Ey zxiD!>nJbqK^O=x^0gTXTZ2C{i&iJw}8A#KP?d55aP+as8wKR9Mc6|Erh@4B~z~z=d z|7_0t+?_vo1MbnE06wiQRk*(&vf*rH*kzD9`*wVvIcny{@99X72Rw@V&T)_4@MP&{ z>}_V^65$K&-?k~LSio5f7o8^`TGOP#X>-8wN2KT3^Yq8U+&b?$#pPVDzUlULYKDZ0 zGioqiWhe-VsFShsmFR;fBUfnAk;UV_3Ypv_d>g;O1wA}Y- z_9OpIv_!u{x1uUzT1>RM(|0w=8wZDcEbi?JOEt3j0B8MU(6;%^m_cK~9%vhj&;4$w zJm1wxvCdDlOzQCUWnESMiG`n>AtQWp{t=-@-S?{MdNgTD>+=i0^+^C$KufVQ2u5kF zz;E&IxkKw#9{_C4ye4rA`XJu_)2k7Uz3vFJ_kzo}xub<9g{ftts?zf)o$o*J!u->% z+JlMrM_0YNc4w!S%d6>=u&Zk*5i$^?lJnFYH2Q zp(By=f*Npv8r**Fl5&pBzY{d&9l3BU_3&F5EW;4ng+y#sVoW#rcjC3iJ9+e+f}s|% zukjM;#hxjvn|a_UaTp92K)hz15PQ^ro@CK?Mz(h_&)+Rp?<;cOXH(~fVVM%EEB*rS zxf!DJSzKC>%$G6tmE>wV|7phl%?+Gb5d)@fq}IA!&5`tvtAQl{u?PnV_<_E(0e$X>|FdW_U*3HUBt940-C3>aO*5)Au&#Gz0Zr;XL@G*(K#u#SV^uJrDnSdJFEghA`x zL6bf_?ZnD!BmA}!Q|OneP`Ysf_`Y#mH!=##@z(SkIv4(g2Nd>xySDbLeGy7WQt$qA z-45L^r>6GK<7oS~DYsUA#z?c5^BZxu`0x4+%icm}8X6i(95jW=zwA`l()X6NtsGQd zuJxD23<^KVojfT%sbxnn>c)KN`}#cPqnz3I6(6K)u#L4&G5HP z?n~8zD;5sm&CS~ETXrk{r2LhS>nk2V57)8x(uTf)zCn)}h(sJBZ%BWiJ3%k%1;^>l z$x6lz=*pC9;6T!gCrge+6JU9m>)fNMF^y-Ub7^5+68Ls=+4yTKJm@`0p`lqeVx!e| z7Ns|eFSAOs2L}!bD8T7hQ{>%iA2Z@vbd0N)TLCc%lWBBQ#QBcpF{?AYDdMU07I zXayIDYnUM~21t*Y68?{#AuI^4V_sT0EtLx@Ki)qOVcwW>0vX^eKbF;Q3cIZkL>h#y zD4%px{Fqj?{>o|NR1~o2`0%VF{Jg=1iviAqPmXQ%#IhlKkWq3_YN}w{qfNhNtthBfC#$@^uW+&uG%4iO~W5%u@INLpbrC>w0N zvlJ)f@4^`>`4vTu)=inLUl6^Uz?0S`jVs2$b-xH@;< zpq7&n$QP-ssjTe5v9gMzE>m%2ValkM>kx>A(wE3bL?i<>6TE5#MCEvatD_c;gm zg%;kYTb?eozxV`a9|<1%PED+DJ5z+ zjmR$AnZ>hkZ4IZ>eIzsVyZ{_XOY^q_tXXll#Lf*i-00krbQr|G$yAyPiW*7x%n~Wx zj8}yrM+wao~c-#h+A;Q0!1#ck11M*DbkP`>j_)M2^MLs5qo&QikaWzB{A@+;^RjPv+rVU@^G6G50b~)b9c7_;LTZctI6}Qe%a1WNA}*a+{!<_-l9Cu#Wh##;@>BgeIb z*RFpcWvIIoL}i!c&?CvVi$C7~s~pSMWM=VansaBai7_`p!R6a& zA_C15V*QgUZZxv$cE0D6?(~a{y!&sIct9rAwec1&C|-wUi)Zl5XxgcPO}i zB3rV-Vu!rh7E1k1%^*x!v4{CbEjD8k?aPE74B#zE3Wu?n_(A(I8YBjNtS<_@cp7K; zHWo&)203O)6HfrTU@mm2cP|N%;xO07g|oqQyM<5dsjTS*u#C@YS7cgB&UgBfepe}r zOVGa|#0#tU^ewH($wB`)SeFlTrcXD7X$^vHhSVm1tY)^Fh~!ak%dq`=3N~Pc!FSlg zXR3ol*P~+Zj?yCNYl;b};^!4RL7hJ0Q5*RFRfdx-H&MA?rW+g*w%L@(WpS`~scZ z|0BQP;Pn5*FT8u>7i!=51((0_3xX2=gI_2i_>*6_`OPmtj{hsa;1T)KFRcB8UvQ)R%`bqL{K+qr75(NH zV*Z_9aQruZ!RMd+f@<==@e6UX|BGKJ{3pNA{s+G>_6NV57k)v5@ReV{B>BxRp!5FU@e3J$5K2HhY0 zLf*gf3mz>0#xD$I{pJ_W|H?0%{=qLO1pk9yI1>AlUm!^Nn_u{wU-+9}_?ut&n_u{w zU-+9}_?ut&n_u{wU-+9}_?ut&n_u{wU-+9}_?ut&n_u`J{KC_(uRb;|I%6s4cNLkx z{P&6@zo6AXnvKOeJgoAA#F7mY34!M0#ngxplaU#T07C)sC@E*`_*Tso&G}vk#Iupw z6fQy*ez;iid2IM_XLEB>@Y+O#y*3d9e>4%Rg>Ov+FzHEh8KvbX;5mh3CM&~x^CC^q$a7=cMU4A` z2TT$gy}xAT{ov3avJ`o4V=^{uIhgcNmI*#wmudjk0UcVRs!OA#t^L@!Vmz0!J|6aU zr0PBSdbgB2W^6i=-fi!aMhi(!FB)jw47$<#!IA0>hkArf>|W z1MDwyFvjFF!ZjW;riN-kL0OC$e95=d0!5SM=llUQE(CFAhhfu8lC* zYJEX%P-L6v#Zl^^4ZV)-gLfW+3(F@>{)LYLvN zlSSb&`S=e6DOF=}-4Inq?0o#>n&6`QjncReM{qGr9Ex9EVkaAIr~okpew$CGBtLUQ z&=gulSA>!I&TWO!^YRyj7q03H%Cb82lf~MYw-{nggjeiXieq!oG7DHb*;f(*>D^Bh zE?Yw3p_9P^q(Op@_>nuh*)P*-OuZE z`H$crdoY?(j5%PhEd-JmDum2;mH>~egNY@J{JJZ+!_rLvQA9bQ8jMqhpqe~D$kcZ86CnA3=_jQj z;2VCo5aaz5yb~mpZ!Lsc(DXlB2xjFoh~&eyQ$$JiW;^hUI_tL<0twg#N;P@F%3dFT zOlE*PThdGwXv;z|wzn~=uF)w)VKE-IKD08vQktEvi?5K);ZyJjP5UWD$#G2bw-y3P zcIexvY84fOzEaNw3~^%Bddh1HQL~qU6jo0|2yIzu{!zLr=*daiX+dCg{7W*J4Ro#S z@mmW)Ovi~2@IB6$H~>XN`dbSD;hzCaX6COt?1ms2&muHEDWQxPoVYnbBq?p_1HP5B zcz@_gQ|9=_H~=-;;~PVZZ*U=u1qaI~dnQ1_nrH|Y{mD3FVqyar2dJbq1&C#}WIPU8 zzjp|<#JC{!f%l3n^&k`LK=5L8v>DXHh~*iT?<7Nkq62uu=*dLc@B(>6$Vox5Ed0u& z6N5r6=Ep_Ii;O`O8J*&#GYz3Rc|6(Ghc5uu4CZ;?o01 zEX{*hTn+XQYa*l+Ku=+t#6SlXbA?OiQWZ_?;m{STGy~xZ!$%^~X&b(!5R>9&swgAe z)#8Ixq<|FSb3!Wasy*zAk(yx`J3X9*yG$mz>aE8OF;p?4p1CaYygVGJ&_I>7`u*l!WI=kaoBMc zQkGOZh7K23w)zzlJugEqEme|NNi%5eFV9j@4MzpT;o1plVZ9My`6J0!q_C8`5yu8e z5+;D^Yckxs#H2Lk=^Icd$lmY@O>(mqB9TjcR@U(TWyRelG$44^|ZIhA;fHLyV$ zyOfy7N!Ie^iCQAs7&UlmKnkG-NFiq8tt>G~boC0Sl9kenyCW@I4V;pQN6F|PGdJO7 z2alIWM@6F*G@&?Ji6py|FnzeSiw~D8Gb5e3{zxI>dsQ+t-XRZkgNi7OM6aQgI1haf z)2E|bK5C2Fx+(k;6q4{%Qhdcujc2R`U>x?14)JB#LY;|_LKxEXGBgB?5=TV%b?2fd zQpK(49gMg3S*h^UdCpFe$_Iy6mT44A1S|KrfBnHYp#NqZtX~<2O6qesTx+?ka~>r4 zWKBQ{0fXPm03LJ^#^7O2RBaV$ zSda?w)@+{W>b2X)Izr(5nM#RoMGLY^5#OzKsp^*WIqCF_Ij5-$Xx5Uvwh(D}mN>=| zdtdB{NPe);V0tNi316g`;ECHIcmEL5E*k-k>M35>X>B|bXlrBo>NxChfyDy#Q=K%z znS`ZR3tx zYKfU^tCh)P*00E837IQR&y_wKmwis=sSH*82D0%QLqGyz2-J5tJf+FN0hi{eh@^?^ z9WwaC5*B9j_Ty?oLOzw)kSX3&R7xU_B%|!E0!_z5M_ILJtA^Fj0d#=Ag|WXWTq zaYZR55%Dmul7sd{Y&HWpHD&aigZ+O<4hho2n04>#G_1!7SBfjE4r0-Wk>*PlR{RvE z<#2aeJr2D2*i@zDf@6iH(kzocMtjM1%UMsv%=JWWQLGH7e%1A|Pbz%>vrX<)im1J{ z0-4Tyo=R>4jO7C*4(C9kum!b#ns`UjjC%K{NYE;oDz5tOm`D~7hx9=x79fr_kp!gf z(}+mnuEvO#4RBd3`kfLsGS3azHaw|?0-LDf=AjTVRrSxQ#4tzZ|9~7K{{lHI()@-T zj!)g#bRt`zo_*8lNBlqE&@+uiZBVF~S!IB4MS&Py_M#@+)G`OmdkR8Z&uJ+-X=6Vf zt_2H`wLgPi$5tZgZvYD)6Cgak#SkO^j3Iu|XvZD0z(Do4NlO+CbP+>!b{+>;5xr{{2R1HnTlvNtFFjex<*zRX)R3Rl5TZj6{gEl_roY8?{rkuS!_%LRgPLpy zeUxuV(D(10Qw#>B5W8ekMA6cLgM*YqMnrty;D@Bz;<_T);PARIg47-y|ItF+&DaEm zAO;n1n`4Wo;$#W&WudJ#jevGD0kGI1$7e_SrP|h)=I`%i;z#y}s@rQbQ7hTH1>B{F zs)mZ$un-f!exjU8CYo!#J{T`d_F9lGqi~~ky-kQ}P>C+D*>#C9zAi+*Y7k~v$o}0z zSpTzynEY=oM0szri+*`cVUbR|^m&s;t*wvmBzo{sUZSFw(miFo;sEGbS*Zi`ap2R!*=RAyJjLeY0z2f}`^H*@l#=?Ne}g5V-C#YX-6uPFrH|5pmJ zEPp!lMDvzH)C_IgVH|Acwnh0^{4(!a@6p-`1w}(7e9FtySV%zJ?C|qyT4$J~|LFYd zu8(IdXkqE)dwWEQLgll@k!L%@o`;9S&a9}(v2K{w>V(x%+{O1$yQ8?N73f*hqpG$t zc+Uc^v!@-3JVTjIzm1;F^EHR-$3uqU7cV#0+qz$i#J^%+blGCh_vSpJR&KhA9C#(t zmcr&-7p6wsJ9?Q9+@lOIHV=A%KD2s2zr*O9*#_GZQA9hCp=?R1EaN!$_*9Ugvk>Qw; zt{r-4MJg==-P;g7dF=qa!GpSfiMtcpWV35VM2)W47?(d$TptFT4z2Di`X-8|#pz`L zl>Bp%4^!Wob!^;Y)qyW}AH2Cw8?Q9Do-ROW{^ebkHoWj-H>j>pYJ~PE1oL{vyyN{= zr?x&lW*cX2Be0@>vV=sS8;n^TZ{2cn;a+3yONLz`UB>+Jq%C)*ch z>3uyasQd2Bo9U3c(vDj{N0^=Gclp`qzHftJu&Xvuno9vS*soK+uJ-6>k{o~hg?y~Z z)mWLu*j-k&JjR;G!0CuLL7v*ju?=hApA4=Mms{t1QGkE3=iY6C8+P_-Ka&g&H_hsa zyOQ?3$T5m1={M_Q6)pzmUuHA_?-=T+TuKvZ<=nh6Z`fjt5+G^rF3KAD_P&d*HAl(g zVi?a|ge9j=EUGobA&T2qiN)@k{!3f4;7^QnRxCU>^sj>S8sKy^K1x?GL^@}ItK10-BikJ{BTb5^fGgKB2&P+wTBPoLpJgw*6{~2B3Wa`Q_(eqR^|~ri-a@LE3bx8DKEhxpdw(Wh-zatY3vT(H(^16PJ`_IFb==Y=jh@vJ?W zj1CvAQF=!!?$51FI<@*c3_Q;=)ElRU$3MN5f{6%QpPVIQE{$x;afx=?2xNW0jO+FMUUIC*rXQlk)khwpLdmm1 zS1Wq`NKf^nXwy0e&_6syGg>1rH^kawWR0Afb7~tM-5i%0(_jmf<)+;^$hXeqja8I* zc&{pTmo7EUHtcefw<152=?83I{lYpp;l=j2V@*tfyqc3eMqx2>PId5oMcRNHG_ zZz{s`o{~PBb@(l9XrwGveDpn9=(+xIRIbsT!>Hkgzli+xn6qoJwxFR9s^iYRH?xmn zb>-X4FZVXRVC166%`HK{@83PlSiAgGTmy+TD4j0^JZ+ z=xI)UW(jjY53&I58S!=M*>U4g^E(cHP(3O=LB11XT*G=`;8yNnp#`CTGRrXrrzu8J zKg~?;JqvdJmYwbXqR+55Qm%#k+iigAyOc}6@_l#IHS3hjd#JpERUVaM6E(Pn&_bBHUQ?jIeId~BV6`Mp5J$+@4zg7 zEVANAKM4BjoOn0cNmDz^@9!Y8CvK2i_F~G>aq4~@k&YXbYxr=wGU43j*|pKfdlGxC z@5hs&7ZU9XSyZ)cn;4gO*Y#lP?($yUZy@MUL1&0eb|JEeTCag>8na0v2#;N0+l=N` z^wJr%y8}(eyal1?`^%Qp3iTuAgK4Io?(A)u1wMxR>O`0t{x^jzGe1Y&qZ?w2LpsSgLI%Z?MEtXLG2UK`a*Z zpU-S<5ms?1+hVvAWV_80=H$Bf9)DeHJ6o}#aC|w?qJ(<-aI}kixmviLtFNm~SgxOh z3Y7O_Ea`-oHzfZYIt-Ge=ZF(Ddh_;Y_mY~Te}B<~tZ z5kFgTG~gQ-V`kGT+xtj;M#3+JxnChZpZRC{oOVJ~R%uiD&Zx4rSNoh&M!@(iX) z_E);$;I@-rp(muq4L~=rQ&_Jl*1GFz`A)6ji{m~_hPXdR4;FrLK{65n@BI2%jOxqAs-$V5) z-N5`7J;1+35Aj&9bVFwm=%IEzPQ~*ROcND8OPNTrOyZ^nju0!Pf9`}({k38ecf{1C zJ+w$7H&~3bS{3f785BcH!wGGa}p-2R_5eO zyp1$XrG<2vCp>K0T^TX4Bl$dU!u@^AVuR~U{`&H(Guw#{uRTalY8XEbmt7t4!E5$F zV~^FX8Z7*)@GX15e#0B)0C)q(E8Z}9LRE@*AoOC!zec({>jB#AA@ut(cVy zD*bgz4X2CX$;PDlZP%%^yxHDNaTmXYj=WAef5eXbN7ohWfzSQChG2L1SJ~JBJdGdQ zA!k^1c?28?mU)^k*!!ICUxrcfii`w4@DS+fwNB6weN5!MDBHK?g3j8Qi1*)<^Plcq zdb#$#y&qxIz=O>Dph&aiNMyw`n|l<7%Dv7HwO7#xx*|}EyWAQ1P zEBCvP6|FRuvgQ>GzsRe9wLEH0$5c?9`PtDYrhhfkfuf)+Gfi0m_nKjpcMAEX@u9Eu zC&zg8NUE)3du^okobve%1UUX<$xn3(geowhY%^MwoJ#=ZgKys51uy|GDwVj@i8mYE8)2-kH_LeMoW%eeRt6E-V)hrgEr;v7U#SOX@;)39-&;vg$n4#oi9*BpQXbTZS0WN#bo;(=r%Bua4lVs zh5&9pTXPiUBwk=2W4>0Yvm&dU3Vq=Q#g%TrX@BZ|-ub{Pi?sITb5Pu?-XJUdoJ#vk zr52z!Y{E%{$5C#4y*jUp~`&!syrXz z553{V6`(hOOd73Ou2(J9!~u?L%T(g}p|2wYU-gD$l01Ok5GD%H8|Gj223#1MwP?7I z{!+)t?+Z}Mk%~eE(et#pnKcgsoa}K7C>`%Pm zgapwZAdQSZe6cp%;N6`eMfb?ISkdUJ|6W7(8a{O4#l6?iYl{55B#k56!M``C%E)X* zrIE(}JPhR1CI!l@VA-INyIc)76oQBfApldNo|cFEkV9T^6DKkEbHF?d+;_~aP=R%V zbX;vaE9QEtT2Ou{XpZ|Nyy)mbvx|OT5QH4Nu)aqBo7W71##s|W>!UY-ZUFoOA<%>W zFmk@_jQC4RKO48Z@l?*w`>lIW-5PJ&sr}tO81w?V2Lx)Wn~mzX?tx(IclUtt);(aX zi6@ToKXGNlYsfl$YS4TyFHe}k_%le@>6w+z#ykk%4dGN_x^*8ND<@(fVHR2CW+Qx< zlUE?E4+Jk_%@UZh0MHHlmetiu(s8>Ju(N5;!V_SJSUB=e6$+#^S$g;UW1z=B*Ei#6 zLcPdk{PN^K79EF0$@!%p?i+EWhy11+xWz-BWn!3LAn9}WLzTc?-Xp^A5uoW1$%t3#zX&Cim)Qj^%5HWWW z*lLs$a?>}Tlj!~egW&3wZV+&Nr5mVFt4xf%>X_c>hTfz<=mxjF>giXyp|{~T-9Tvd zL%FN7d%9{fkr+TXpom_z5#U>_>b3(p=vAHxhGgl@M4C~ZWJm$%hE>8J=D^K_hqYQe zx=SG!D%LiuUI4j)(97ZQi}VL&R_Ir`fm{Af zZa~N1Y9t#Z&Hbp_J|q3k`$6Nq(cB!W=UiT%-&gu} z#ZLpYs~n$^enD=lSE~8FzgH%M6?WZl;$*Pq_w<^~s7iCd?0SAWFTK_~vTu2^SqI8I zhoNoA3g9mwp$vS#k?f^?#6@5KIA=y^w6Vx|;vlxcXz*yesCz~$Q^nk%d)daA)X~{- zwZ^#AQQUFM$*6|n!0^PY-11v)2>mTLq;U|o=ZoL~krZPNk8lWCU4r*8qS8t({i11! zWdm9idB3ZFS)(h3C=~=XQQbDxN3T)$v+8-z?L@C~>&q^ua-9X*UU^?m1R{FAJ;W>z z)kl<+UPEEJQKz|EkpYGA7kBiZo38o#xUlqzzB=k{l7zYMjJ!=!-Q%n^Cz9|TkBLjMrp3lxZ+@Hb{HvH*tV3qJ2U+D(PlQTC4 z$(=Jd#)$g0Giwmmy0vo@U6xOmiMoxYKdGlX^%-Tq@AaFikWJf};j5A8x`0%=yx9#) zs|JEJroP})5(a&)9p>jNq|>bw?SH3IVFS{fh$@sN>=JQ>_lWGx7sjD<662()s2*$;sQ*s zYE$qATrM{6(U;T94cW73WR`AOR5p(eFV1^v!mH#*gglM7>Pw+sM+8Zokj$8IT$oV9 z7DFHU(35(wSy<_>Vp$YL93IYS_Hl9Qv^5nv+H;)Pet0&2kilQqt8?h7_4VC`xVRl1 z`LN93N4@&xY0BM8cJQfEPr#?h?PU|dHwZm-0{Di9+gm-Ol|iS55x_a5pGCgk52l;$cb;PlM(#=KI zUu(^x7w7b56{ioOze(_V`{2 z2kbLhOc~Lbwhk%Ux^UL~j9k?R=i z0)=tTNHY6S1Js9)aBZW+7D=D*qC9G_*P{0I8EP_D&ZZQGD=2b;>HBnKwr@&_4l)kp zo!-A14#q4^t3_0183#O0zARI2fvTpdo5Pl4bYm6WMYs?eXUfthT-4+l2b@YT%u6;X z>!Y%3Qe3M;1{m|B{6tIpB?PaAsJ-POxm3^%Fa|V&+E; zsUQ0x<*iS!Bq~MpDPb#xjRapftr=GS)o~~-V99{qN2+iOsFPJBVP{NCgtjhzQQKw~ zPGJLyQU}ltGXth@sLN6=_3iy&c8geWnT*02%@9$8GV>JYgN8>a-U!BmYz!pANzD~v zmBhfuPbIRikb^N1a0=TH7zhz?Fq>rDvV;&(3`aix(3eV~ zu9}^+lX(KGWHQTyQ%R|kFix3wp`eDrN|`=EQFV$h$DXsF%Nr#lyGqJ5G14VKs9iQf z1r~1@_M!{tHX}wni_eqP4Ci|yn{yS%gg^Z$IT$2y0CQ`CSt;LzJBlMwLP(HkAU8{{ zWZ7sKBvmSC_djN`1qG{B*M(#hvjV?lvVnT=pW&W9Gq|61o!=C8>7U1bNz6h<9?N*>UI0EaO?h1=72?xNZX5y;r&*Phq&mRRzHM5=@$dDBAeL33nf;ey zsg%@qVjE}##gpf;sR|{FL9BWUa`E=#twG?fAiQ`p=b}F0eThQ;75WQaXmoEOTqK@} z6ymfP3*K{!sPXKq{#uXWL!UOoDGARrblre0ECaeenfejVxej(L-Zh-_kkAIy++SSPiW1?C?s}foWXCMv-KyMWZbyyq*M@o`8G_^-kBOZkK#*!#X4OKk&(*K!$os7Gqzow#~F7 zUjQtJL4f5Dx8tL{56>Nq_G&q(rVZEmhfqD4AMfeiVU>ro5)y*hP=BW1#!43hSPmJm zND(#s_BtF4`WyVXc{N(akwz;E9#6QuDl2%wU_=?_9K(SE++)$UvSY?oXL+{L8X@;* zN6H`rnWc`1g)l7amSvFvnW=0wHAA-enX0IjCnu;kEXzwthi7i>v-!)t`)ltbdU{N$ z0`)fWPrpaE@U>(5VIHN-mxoi<1aCl!vxOBg40o5A#WMPR35#I(^L14t%@+zG6+Otz9EIdyT8L65#}OflZ`jO9Ua+B4 z(oZ5dP^(wpWF`3a=#6;xkR1XH=~X_$9rh)-MTxiOZx1rlJggFLf`@1q3O_TkmUsrG zg%VX{>Q`z(Ly{@OdpmIPArGh!*S@b3an6AldaY*9!6Zzoe}WL)ThOb1Njov7$H zg@xqKhP^YFrNP9>BDa#YbTuzt%D>!*pA5tR1($+>4dh2?=J~phoS#Ch_^xwDGpu9S zf|)7fCR)6;Kp<%kF<*#vI1zh6vsfW&HTbdEQqGcwT>AqkLlN0Wm!)J<1jwa@k#4xw zA~@`-{$eg=a<&iI@KUlt;Zj;SL$Fqg{qnW_mty?ZiJOaR!vW|yhzMkGQl{NST;WaO z2p?3jnxHDC&<7KPq_&EriA4xNWoUiU_{RE^ZDxr(nZK(BVuNn3J)l9DPvV1aR*gP@ zWYvvwP_>xHxFNBBqY^_Ax8u(>E@Bm2{!xS$Fv!1)^liZ0QK1CSR6q)MP#7%%;`4N^ zwi3c#x)_v$^m?E>QYh{z3@ZW@M>6^q6Oye@+w7@$AskYQE39}o;zK@_A&~SM^CVFl z{8N(u_dKv*Yfg`}{-h4bhs+;8nGiDr2?HbN(QI$PLr0uKbbO?ug3}$V7?o#UO$VDq zRN}&#Ub2Xo`Vj3ZMm{Ph(VDARj!idBnkVCzvH(N;=olLKSub zu9_{M@sx=;)*QR`W=Eur>w~3DNr34ri!|ZR=q5aITfykFfGxXxvw*4@pNCId+(McRRZ16p2+Yinio1n59WXvodfB%d7 zvgsu)e3~bVQMT2Pa?j~;7}p84TPX#%3AzN9;y~?K5>pZ_wMGtw+8i^pKr06OwhXb> zEM^J?#LZdoP1&b);4libiG{6Ntngy(*(WjiWvpY?!cn0#gcbyuA`x+9Npdq{{X^jc zf?#R?NRp4N`IRDe$BH4xsnz9;!Qg`*f~gFJB{8`rU0DohVy?MVs`AM?Rk2<+7D`5m z@Ah3v7P-{#p|3aH%gW$tRn1VcN0TdMxDBCMaqK@VQmML8L(&-)4qX>JRSi1k=-kww zVbGTnk;9ieFSG61T9fVCn&MQ-d5`+%MD>TkgDhyfe2Gyq9HkO+t$1u^HzW5z0;MOu z$CDM1A|)9jixEmw0Ma0X?E<;Z?|;0n%urNaj;%Wcmms0RlH7nIqNRAJcpGkvOu@E2 zL+WPiVi|w^COgQwQsQd}CBX*#H`$@-L0j?`G8w68=g8^3Rsq>4y(~F-DZPA`f>N7c zOiDVNL`u4*WvJBCuo+bMxd}emQ!rPAi6IQB6Y5tMlrf>WxON2AiSQ_YR~%!4tp0a! zflB-x3^9|Ux*_CFueJk}gNX(miyWZp#!n^fNU)RbxXr z*$`4@C+bg_kzb0b>M4lC1JEa^V2XH&<9`DW@7akr7EvFTtM!XX~^IijsXEaS+@#hoM+L z!+>)A=oGpuQ1xV%UY~cMI?p8TE3NritnTjny`9!qah!IMKqa4<8j&Xdv%yFdj9UCd zrU;yvazzrv9W^))snU*ez6#_%F}MIB@{Uq?zzZ!5Gt&t?I94p0GS!!5OtjPb^wlVH@B*tb)S0rGHX+IN(MJSxMA9m>xqd)^R%Ahh}>6A47Gm zC@w=YY_B9**pzC#RtcF`;74ZUlWU_CPn}Vq_!+#){nx8~Iat zfP7UR@c(a>2iOrp!TAzhCihz*bnEB*Ac}q9%L|ndKB`-{OxZ3CLa~6m_bwhFvkm!qE&Tzdm<4BT#4csyYGto( zYRlKdIhs6nj%RGl?LUl%9Dwmaj0Y_p2jvg$voAyYfD$u=E*f00-M9OIv_qD_++Gg3 zcF##2p27y%vQ3{5pazd%-)l-zbVh?m&}&ChBo1AW;O}NtqHhB&-l0{&@q?DQf@30z zN}FAT86jv}GJzNeSy<1TU3_4-5f90BYMiRYKQ(QyhL9HYIc9NxAC-8*N5C4YXWJL4 z)NBoKiOh?n)b1`m(UKr0VWHBq*0Ps~)Z~O_I*}E^sH(Lcq?YbdFP^NwydSvg6?h0w z5`<2?Ih}Y1I337k^E6d6nyFd!Rfe2A+tt4PDes+uG_`DZx*QdQ}4C2%z zl*#**!Ib=T$V#miW>al-+V^$RE8nv8B9LQID!;-j1me2}aYCNTOr%GmmG-yiFB z^OQiSm#QXZF`>V^&S(&Ri9V)*>s`^DME5M(1$&kXj|l~VmipWRY`A#DK7!XiI3@qPDeF!TM6mSA1M_}Q@dasBCt|9*?s8mkHZ@u! zqQPZg-kx%uF%xlFwK;TQKA8lnO;#N``LY)OSKWaGpgYW~hFiOJ7h_divd<_BQCZBU z)S+=9v*jas^#-kupFKbs5z(;`j9E)FR% z7M>4ciAf>P1GC*=RVWh&Ip0m{m+LyFX_4CV2jlY`^v?l7RQp5`?zx!w(YR17#mwlsu;)kx0IVDKRd-N&B*qrPI+yueA22dvWq?9RK?+yq6M@G9!viQ8_C-wt z^P3r=qhy}zm6eb;)8@lwvjfIiEwCsj;4)Ou&Gh%=MSft1vGyn)qPz?bq?3E9fUNw| z;6%vOtSzqT9FZ&-MbQOZxCtws$b3&uOwGwQnduC8N*J5TwV@$ZhA7h0rht}kg}2-W zfwfm|5vRt)qvXs(&8{`QUPIecbVL>+? z$rYc-UqJ{38`0Na5Ut|p8-~RPM}0^83_bRysTZO(+p3KJ@v){wl%6-BX*b6)t1 z92VWc6qtUuo3lT~4gqotoG|!-^$cl8;*NXBFGNI zP6{6+#qc@{4w`XT{g+4vlk|GGPcnRaD~I>lPR_M61>F1Hcx0*QZbd*pk*3*bDL(;f z8cBXy8VTT1n05f}Fo!;pnXSG|Ly{3Wu1JDd7YcbWE#CL0|eIzQN!&Ox+ zIZ>3@D#l`6xjp?bfeS>_+tBf2!7xCKY3Q>c_^IK%Ac0v2fm zoLpg2*pzr>PJN2}`1w-sUXl`O6)D(ibIKq2Fx)jwG~OZVYbmOHo|A^@fpMXS? z^%&4a(bd+)0TLevU4JN(!~bbJ$ZwU)W}=0VS-#m0j$N{B;0QIy0+a29&4%i(Fp?v^ zR4{`~5*hd@0SFONx046&mu1sy($mol{cIEDYf{poc7tpakd|#P#oddVSG0YXfTf7l z3Mh#%q)MJSSwt9HsK`@%f7=cd#f>caRO|C6zio#Fg-7U!%)@c(YGER3u)=y37Oa2T z4kV?w!d<^7=mxEE6(Ss;p@ycfS_- zh>4|}iag4j>0^t7T_Zs8qqFMEBu~N*5x#GzSIpaCa9@i`M8tS^m6kZUR_quqo&u5- z6PDq@w171kAcWRw=xeV35G;iOd*jH@N}+>M($XE_7B`pgsCiOdC7KU|s-aRPl=4y@ zdGv%!6d1ZN^+}D1Pn0SLvU21zYkGNUGplVmyIt#<5SyZL0A?AD>wPC0Tp?j}1lc~O zP~bQXlCognoG};r2`cQxT1de>^=ZROIuy7n0Vh?lN`r94xKOyWZrx>5zx6J`5e5s; zV0!2)?vN>frFWt1l=3oacSA6xr~P2q5gCjCaiZ&-ZxxOok<=9sK0j5i`$ar~R62|7 zjL$c1{TzLdg&afnGkU~nWdu5GV@-lj#zLs?J`xuQP*L#|OEkW5BZv`L5l#rxB$9C zVv9sTR8FAEX*rHa2dpWlq2@3?&`(4;EUV*mWeBj*EIGbt$<;3mZb*bVDZ*XE8od`kF2w3}Eejg^>?t|+1iXjBO3agrhdz;{qjr4XT+$8ZU@BUvlEJw;s)Y3puzM2rSpuluw|zk=9LHL0>Tl~+0V-+YJ5c|~$| zWF81|y+S!_)3H%VjL zwr$&X8aFl@Hg=OV_L=Qkd#|M*?=!-p$SKQj9&Q5olD>JST`U%5PMMZH9F^K96H1{$#3 z+Kb0%nkkc9Y=Ys$2op5)ET>S@{uNAk_m!-S@3YX5xyfawJ}OB3_dCRi4;8|0CXitH zo?J(ySCcpd=oe#`R4i8zoZ3M%m1cYy<5WaITQtPM5EmgtM<)f46~s>Zpp?+I27XxE z7~o;SOTX$4G}M_pKpyPCg8_11F>KtKEC#HWK$qtX2QVo+FQ2zZJ&VE+=GB?^Tj-w9 z5&8$V=sLa9ae@-*0-0!_VPJFNLj5n>IN>Na_CcSbfUvUTXANK!_J8UOGzS1uUe84smg8_O$gJMqz0gnC5u3=yg z1{%^pitbcY0-nbu-tP{9L)wWFP+NpY>Q`^oA<6No_@SKhx>At%-i)&q!LwB}$<}j| z;V%0%^W5m()EgH;f!FKO*GErOoZss3ZGY0J(@dvu%JqGb`$x2R>M&WthT~K1)YV?a z+9YM7u#@Zk-8nB?cw&s~lh6pJWEzHZ=)@(>4u?P!yYPSL~}SHIUH7#KDoAW=~j z6mzHAk2!vN?$PSg+@tRDecuC}w|e8}ZRYC_pUeJ8(Zr2cS-V18jJ1u|*2q`h8+1Jf z@$1P3oG8${$H41rMgm^Acg{6Yw=-1*Xbe`Ucc*SW-RXPEOb;gjyC2?*m7k8e-~%39KM#KlSqDU z>*3??hWz-<*~9nY3n7Ab_7}8@^|PU!i-1RHcN%WEd}n9&`clm~UF3CAyL zO=g*oEol#!0Z8RDH66|2b!{&U~rD?#>b z8@|xLK(@~hx2&v~YSzd^r|wy)Z{OR-$m_#or{9f(SnJ_YDqZV+rs41L+<$8wU(5|y&wTZ1e7<{o zrHS_Bg5N&nLxu4L@r0E=H)HL2n}508@ho&-Wa(vykS*bVj;WTd)xN9&3vD82Ke*4K=I$`(ps6!?EpTk#JWuiM(sk;8SZLP_Dwk(A zPgbfx2>UWEE&}xvusrSe2u$}mdZ}q!0fTc0MaUl(a%8!Vplc^PsW)z6W7 z1$~|lO)HGb%nh^Pjitie2y^3yEDxW}9`0`(z67Nyn^&6R_DOPp*AyY8Dx3{-ykK~f z9DdA&_C~5b;4J%(V7o#nFa4QVNbqjjv?rnLVD~xym2R3hqtIq}A zZCLB|enpJ{j{*Lxsd^eS8ygz&{pOVV_43f_YWL&TkCsR#K^6PX=R-t-w;C&>d)o*E zq`ec7AFqct-A|mnNQ+A%^%p*{RcM9-m2_^pJ=<%S2Ht4ONINHYWE1I12f$UM#;uX( z1b65&LZosY7m1LdPmdNC0|IyN9$si$)0s77X%OYny&91!WqRTBcRZ> zfa^De9-=QslUg}>wwz-M*O^l*#Kd%~bllNwHsi+00Ma05s^m4&E5ufPsFNr`?TwdE z?(;lm>SGkk&;EUZ_&Gqm;q$;*fJMJ0`A+e?kU-J59x@Mua+S6K=j2#@iN`3F5I?anJiI9Www_aZ_>BLyw>)2^JJTZX!MHHmHVlusXjE+0eLwj z;T9-5rtHg7xfEKwjVQ7ezhBPZ%q@uUb?m>DH}8A8=qha z*nYJevLn>+WRD|64ZoD~;p~-NT`?%zlSZiLe(x^PV5xM*%DumktB{-R8KIm%+i_?S z;5)6WYn0=!I2qE$%6@ig)wgOqcOk&Iy+6(T z3A8P#p~hd_Fuqt3Z;hrn*0U9ifGSss?$)_8ohXL7C{iCe_sH-9lbG_|BJ0KLCeyQs z&6l4Cv`ttSB~y62K$2K+3ZEYT*kRo_NA~(#p1_OG(uHQ-m2g_n?{0(HHU!9C>8E`* zg4nN(Kgv=)f#AinqwM45DZVMAQYf*HHJf079xHseIsEY>Ruz}J1?2{+xeq+0sM5zeUA3?if5Z?vTVD~D88nVoSuA9ET8vFtN zv?vPfli(^opqF_9s5S&gZAKYJ?h%XDy@QK!@ zB04C_yMSJr2u<=k>w+$-(xdf&RTj@VDj%npt2k{{4M#&r4e#IEfZqacePh8m@koJ` zzp`ML+)T_lDBHcy8pBZq6=sd>uRo zL>nxrFu(jQ+90cw#W@OIz0QtVSMqIFs3zv=q}mBx@}guF-lZJhId>mZ)1d~*Jvtyc zhjFlMKrGxUgYS2=Ax%ex7Z7boq1HIbwvLgCpWcFaMT~hTM+{&ws-Oo&rtpFb1+HiG zg8Ln9U|jCRB=Q188!$0{MH`lC(*eP z4Y=^$O@L@a`kiJ3`0N4lV8n|fg`su=>`;PEl*cROYpiVm{~MYJk-%(1yIo@YWny?{ zp73_iZQ~o!@=_+(@vmqD4FqyiQ;S2?*MCPFN(6@>^-YTAIwffne#wR0386-|aBnft zjA({ibh#%G z6^s}>$&>)1#vKdG6Nx=HsVjx0TM6?HcawUy`Ne(-U)S7*y`W5Kfw8f^qm5`zvmBQ| z(o>WLG9{4v2=V&c<;hMx2eRErBi_T0Myo96(nmKJ?u?sid`^F_@c{z(td?a37i>>A zQ*_Q3J(~VJ-`U)!z<}P&-`R#kUSpNt*@pd_Q5|AQ|8$^8dkNdG5a82uMtAQSi>eBt=N@de$#_`(X|zxe`5;(y}{ z&VTWRtbg!@PyaXgLXpfLe4+LiUl`T+i!TgT|BWx~{lym`0ojIs@&&?Qd?7#MH(y|$ z`#WDS_}}=#+kf%}O~-%o1(YAZ`9j{wZ@!@P@(;d%q46hQAo>r!04O#6N4Mecd_iX7 z7hed^{=dK%@S<|=Lh0o(-nSbBrYIX_)~MR&PzaoRraetc;1Rz&L9KTR)Z)^&O5gk%DRXMaa^K~Ya&Ex_{~>>%^s&ljmWRxs3bQW9BoQnM zRGeHQh;jLo-D;E*vdNdd4n%PQer)5d!$t#~C>f*(@7WCg(He;PZ?WIFd^tKYG^!Kp ze&U+t$ICD@*2I>q-Mt7ZnmToTdewjM4DH&6Z*z!UoD* zq7PgK`lj8JNGB%6U2%uklSx`5ArBHAknQ`)qdXo@(0O-LgKUF& zp%0c1MA)g|Twd_vF^#Fb9s1%uO)&AzmkgL%bq$DnF>(`g&edq5u;JEIWG5%BVP<+0 zVa~Ja(8y9D$_Yv6C7NhOzHY*w@o1XV2ma4 zsV*LpGc(3?*UN#u?kxL~Bq8F%RO3mduEs+`Lf0rqx^9ekcV&&H=;by!e91b2y`61e>y&BD`g;o+-6;{Zs{F3)Ue z<{t7M%>}?om@E;NZubr6I1SETdsS_uT;+x(z$vb%G2VBX##Y{HLTY>KNM+>f$`Z!b zgmmw?*tUnhlQB-g>uKJW2*@VqeC6`3u-W^@s9juYcov#@VHDoU5{j1eRHo(tW5aAN z??7Jq9UaA!T1w}EP(JdML~@tFhi58;wuJMC1|1(qY3xMmYhPa58+HnNW1kfZe)M7_ z&*mp*>d~m{$XPadxzKLFeGX)ezJS?uz*A78A^)pAo7$3jap})J@Wb)9JYx_?IC#pp zh0^$?NrsozUEmwvZmq5OZUtHhCKDH7|f#B&v^W z`ot|VF}$SeL_K!9GVgOC<@f#Ab|ZtV1!i!OUew_cA4OcN)N+NAVsTZI!WZl7y42J1 zbhczz^%aw1vYk2~^LXslO!*CuSoIBVP|Vp!I^?-L%5`=14i>FPAX z8Fc(onHFzz`zLEmhggzspo-ac_)ZZ$8i7_39ha+YYmWPuX@7ScNV=q{Z7+Epo1AuW zlThgxJqeXv0J}=OcqLDy;~(kXI{5z}E6P#ZEE+^Ji5fNTR=r}=b)p=}&fCWp&Hgo#3FHRV}#a;X|BX7PqD zN7O;hB~IizxYC$ZYo{$_{2bRsME3RJA#@i&F$mmY=urLmj&6x-7xoTnOS@Phz~@Ds z5KPo@)`pAOOwh%0t+P5#z2Pi4OJ(%tFt52yE?!L2sCigR9o5;;c|1)$)|u0J&P=5V=fr%&FV|vv z-t9*;|JbX{C$zmSor$QUKnxFrJO{gDgqzp&5U`mVj$U-^o2(^{17uFzZCCrCR#OyO zBot)4w6?zmcsKI8=yTO^!?0-c^AfjwnH9!RXl@z#iqx{AJf6Qd-RoFj|`zl_IRNI;*jeN-&<#SGGfI@cDhs;~BO2S@yN$TIQ2Ja(@#EWMxqM zG;B4Zb{(=etmX*;%cORSUKU-=F@6+DPnfC)(WtWy;)aR971dIESh>G7rrK_#qPbCPi4!k8se>DVqvF$`^D_@rBwb?^;R}vpz|O(cDLE zz>5zL=LVN87QrB+m|qauLkD1mQSns;ius$S5d?r{Fl0>dV@WSz6|In`xb94)hvK6@ zJ&JSF`pV*8H_wvCz*uUcpp3;uPkMT7r6smZxzKc0C!J;PF3liXVv?0O!bG2#-Rowq zb%n8zQew!NPAfbAgH=`QlaaX@Z&e8O%%Jd_5l?MV_~T$-kyHEuOXhuj68Ie0^_P_R z4;hVYjFwT2vm%byrd9e`nbm8Wid>wTPA%O&jW5LrXEn>Mdg=lKwt=pmyE}XqsXb_x z4sRx%ycC8$iwwD6W_jMNJ9Q|Cd^Q+jAH6)EYw9ev+g6O&dp3GlXL`(2w^ELRd-7-e zDcWOuFk+FLrbZSMn{UF5WIW9h!VTI^dk+g07L8_ZEIE~3rN z^Ik+a;Y+9-^L&g;nsfCA0xiDSQurddRm)7dX~zI&PBy7oE`eu0C8HZ6ajg;{^k$Z$ zQ1^(xKMx&JF$>+lFg~LqknjWz@?3C1$c7gAwjz&({@V9yfQh9{l3^*8UZ%r>pAoSx z8VDBhX0|4SsP(i50-4XtKi9BaHAy;$^wM1<-h{p)w-5N2$dkdQH4gp^A1qD}ox*kDobK%-L)`yRqa8X*n?{Fl>E%dmJ>M zQ>;G_F1kBZx=dnjh^2x<9~_O)xFZXqD@U$iJBT*E7tg~4>fYTo0=Xf9z<6~*ly}N! z(UnKKLl~tiO}*r??$7S(S-R6swM_9j$2!P6yz|uwZa-y~rHBVvv+08GrkonN+Ov<< z?Fl~2XYWKgm%s+M9m}Lj?iDn8NSG(cSx0csJ5rr5mJ8#hdP&Go1hFbJ(5;t`UYjz+ z9vR!HH6+gl5j{o0$SA`ram;sDe6ZlS#h{=WC0t$;0A~q)lTA}SOE&7Y7Q2tGgSJC_ z0n!JoPBH6JyG#$z+9g?BL7adG1OtS$^m&sJreVfKy+mVpQ-70Il z+<6pho}t{s6-D73s15hB4$(4Au{z)AW=;_76{KWD7gn4>5*xbH0)sVrW7+X?2tq83_cc; z#4|ovjhW^!o)gx)V&Xx9!ku~? zCBddsB2eJ)n3fYRyz=RZjGr;~IG+sZ$H)&UocNeL=~ZybQGf`TS4f`-vJYG6=vAkn ziqF8590g-ndZ)Qa%ag+K7p0{zOFS?DOqHG#ack%p1aO$cK}@FR$!GBAd{c~?u+?JWf+10#{miB6p5dZ62*z73onx9F&*|2 zZy^(v)yDOgk@m)wM3^gsxvz53OX2q|l26VPjUy*X!rrFYfq@x;C}Y`xp>2>@4ButA zlroJ$@e~z*!%UF~tZ>r=6PmMP+KM2OUkx36BQc9tGg9b+V#S*i6M4fBlD!O4@*1v{ z%=E*f3t%hv6lo&~Lk%R2uY}SnI+<*)td(4(q&M)E%@FFRSz7LwnM()qmCf+)%(;cX z^}+1C-MI6Z)va}TKKCle?Bt{0p<^J7jFxW)3~osfJTy$+d5jttK@U zTk+L?U_EPeMiSi&NT3!KL0G-!;z?x{w!<39xg=6YaA=BTO8#tH3i2`b670Yb?txwS zlZT=<2tS9ydjGsRAcPjAc&>wpTSWS6<-c{IOs=SvbiX?(>2reu=`R;iESLE^5F~q@~aR$v52i2e9;Q&9ra#eG#^%{ zs~S%@mBI8_#DHeBOAK2$nF0cftqJh3!6kxLdR)xfvz+MZB|4>{x|5?1Z_(N176`&1 zaWbs9Mnbt+pTsyyKGiSY%5xM~3cuVsQu`aoDz`x@f~Vs&DGv$CN@pxB8MYwERzNS_ z+=P2zpBzhG-}2~uRX#Cm$&S<3be7R{;~CbQYzJ3`D+iQv>snFyDy{2hw?O_kpVk4}hP@G(F=e}V4ux<>D%Dsx#B)*>`_qFt9HP3HLrMqhhDZy0=6aH0Lt6*IU zwKc@`)=0+?iME36HdeCNY20~$F#T+vPg=TCSD*C9I2BpO#i}4slyZnKTzHT=^*?hk z;i%GcF2}mselpr~K*vX=NhVN#OFh~IozNU8yrHiBHXtm2_>q*AA{jP%GJ%bPjfZv4 zeCEMQ!bB+2KY%P4ypI4<3;*s4YGw?Higd%aYCvbF5i4!N<15LULayW$q(UCH(P)$z z-CU`trLebB69ro`N_97Isv^pHyZIP$XyEaYksidFVn~##ff8Oh3gA^_2w92HU=dyP zb}$>20j2tPw*mt8QR`!xo!*EkNJx|rGL}t6yg^NoP(GR{&7g&S7{k%Nq92OINW`)J z#mQf!b3Pf2u^%FBV7bxsMfsnfdclCQ?#K9_tL}RFPpW^yP10)o$`gj;ibfJ%&_Wk3IY9%^%KsiunMoK zF?h!w&2v#{hjEGowvrINI5JCo6^&*lVmOCK9%>zWM7+9XzDX{hyKfHj5Bncqj$ zh`l2lb->kY`p-TjlooI|*ovR>q(ikrixu+=po$V2kQlG?91w-c1x1n1u@zMFIh@Lb zout)NH2Xoe`GnExh>9Zd$avBjlfSxWm8&YC=+eNwpB*Xf#ywxPE1Bcbz63p5cg`zA zs8_H+%YBksEXJz~!iI0(&Ls~HUmAHw`okh~Bma*L4T4HLxj#wq=1 z6M}X9-4zVHy%uGtXe@@+uLDSt(cy}$z~azRNvS+V>Y-3^E)L>(>bcoQ9+9u;{Cp@n z5@TrdMuU5m!YE|Tw1^2rF&K!UAnjJ@H2A-M^P(qv29*k%y}0J;u2MkR#VAQYna3#I zC@ovd{VFAsQ79!t$2LIbv%>e z$LQ!y7UQRrCYuEa2@wJ#lwxJ%)?BFtk8tJi2r$kLmG~bmuh#QH*DLW>7*+@>Q4MzR zymMbka+5ZKJ_7sgC5MhC_*W%|7Mu~!ss6;iHl@yFDr+GRxB|o-q)o>82l!%BIL4n)#=&Mzf-bx$Fh7yBPFZO4P-TU(Jt)mN2?V+2;QqQC% zL82>M*6xS~(~Nk@5<`%bFGvPHCxK+gm)TO!lm}kLf#k-9T~G}QzM}_YrQL*pz=^|9 zqdAS;okA07V3dBRB00YWLnE%7K@mqbzo5*6It32qk@->n@)Iw--$Js=0YDe# zs=2POz_5IJccD8}=9FQWbX4Px?1~>atrqGSE%+nPLQY>pmpQ=Z652geL^haEnK@K)U!BD$r=lD<;rb z>qp)|y4kmU2-T6`omj#nB?hbyo_R3MJ~KjzSAGxo<-!DL&pfgv8)571=0trJdjS)TR`q6k_ZlTn<=v%8qza<<$%7Ti`QOnEEw1MX2&J=42h#A6E zm>sPAkS2UH70n3Y@QXtoVIsNZhNaGtjpvnPzmkl^8Yu$v6xyBJYKkMb@}>vPFo-;4 zaHDfnhG*0dyW9HG%M4wsA6Iq*$)rJ+>FkMH`U4h=O-^->(ke+6*;@d8m`aKl-#&QI z2Rd+=#N=^=Q{dRTD`Yn4$<}bN*J3>Rq9_GwvOduWv;`uhR8fynT}`LixpF9nwmu&5 zTcr9GE;K#7)RzpZl9Cay<{;Q5Ra!aOf~aP@YT-iTxRjt2F|31Vs=|&#PMR`1Z&qC; zS)~MaM+1tJqQZ}up&8X&jnJoUq8BYYD(fsQ{jcuDe9%hR(Wg5tV^)tASIhf0Js-Hg zq5!Ub?C$cw-ys1he?^f<=SAvOG2~UMlB;J5Mv4I|76=piXJA$}h;bQC3 zE6g@w1WRWj(DEe{ZBQyBQ0pRPq_+YBl2e~0e%2Ws0db2XezqWJMxwW)NvXCus9?QH z1@|dAP9<|s6s;O3A1hSIwrB(?IxLUjOGd$WJ5272F4-670 z1}fkE7R^-^IR{5`!A3o9jSG{&m8R2q(}brcWbH%dCntAZp$0ty`)RaQ5i#rEctmmS z><3%)tL>Qm+cb$L@m(+*P;R%IXw-wxX)H}!eArbRp#93zt%_t7*yde@aF5Am7P^Gp z!SM7o4UkOWQ03SyBrrG)o`3=&3pJSSPJ~oYdz#yiNe^-g==Nc{X6*vr$Ogqe`Ue%g^2j75 z2%srFo)RfaLDXj`pv9>|FNPujgTt4NeECk4>|mNcq6eAUAULsU;(Wc2P8OvzPESdqB{7`I3-Np`iF+!JvI;*Hu6wL7@rzMkgeQ%%TIUL05qpc|{vi zlBeE6G)P88G82;FiC?zfLiKJvNlC?F1W``0MACUWJx1xgmY^47svGjS1CSYwNHdR~ zQq;mjhAA~s66@iZI!qQ6jzSpkmXM_}ykNNOR-XwChF8(@y`Z!ZMDW9%Xq1?+S`GAr z^S*FE74kUTT)$F1(UDO4*Rce7ke0Lb(s>g9yGzOMCAv<@t7P_qAOyUIy>kAcG&ZOr zyylYD^|P0~%!k%6Tr+m#*|Reg=zL2*QS#5~s3nQ;8G)noKadkEE=$*OKV&9|kY_JJ zk{G73<9t|kvs((HC0GGXtZ14~AQ^0iq>xltFGBuc^UN0SVPpiEO0DFIIxz9&TzTNB zd=&r1USmsMPM>zJSQpotVJ;1(CfFrxCef-Tc$Nb+iRv{DjwtGm+-{|JXQzoV95E3Y z5Fr;qzy`-px+}gSW)V_YO${0<_R%OW3pFXQkG7APHn@eNZ}K7P0#V!$2nu!?u57`TpSbGcEBfTeM5;h z4Ai1wBd5UphRjtq1 z${4PO_ya^zoq49|Fbzi21;#TLkRJn#7;BI67YPVNri`Gp=E`Bd^zyW;^OMmP+}A{bAj%(o&k8D8ItJ*m_$Xt5GkS? zh*nZE9F7sJ{3y=S_c;GV*91{Hy~3M(tV)RVp5^iEydlRjx#3SmOYl^awTpytRc322 zoBE4YCd!hML?BB@WmJLl>s>rCsR52$@ndB`9n*Pu-X@s(Cc8AbMZ}l}@T$bB$rc(e z?jq)!ZP531>nZthag0)8RmM=^#AzWL(dBB2I$Z@GiRi*)>h-kQVMixgL#)IIhN}E1 zGb)o!$!d^~yGc6*-cj+R)X+;PI_WdxqfZK9A2n=v04;_kLn{DdV5ZKlf;WZ(Vg;2L z11b+Y#fu{{@k>jNE#iVAZ%q`6OPYCt>G)85HF>2XxBVqCIXnxM2Hy|m~)Vn7zESQn*ugDB>Z${ zP$2*cBbirGEOCfkL!{IUm?HoOjaZ|pH?NGT$TBH%tc)zeQ6n-)QA~|}u9wu>kjJAu z0iw1hW(}wRMxxY4g+ew$7^O*>ra}y*O_w4AByc|OkYM}vj_K5N|NJQ4rn0<*T4h=+cg&I4GjFPc9 z?G$nc!3$ZrUTVyOSV`^bj5H4U)ke&+++$ON1$bgSqlAdQ20AEpl?E3*`LjZKqOOn{ zP9=_#jCEQC8QOjZ@%#*fNLz@~q&xboRnHE^$0$jy8}?S*w4mAY=;%g}0fr$@kW^nt0L@>Hc0<5)O{bZ5B9&I_;iS&_kTAPC% z!=Dwns+^Vmo5y%EaF#@gezDgA!Br?a>BmP%vljP;lcN({R&5Dw<{JhK_E1-xM*|b zD|sr$L?YZZ%MY3c&33Vlu-HI`G9S-Eg}G%3qiS5s+oXJVTRdX-8LGYNbVP+A1DzPS zXV?Z~21hppMUG5V7=9LvAQ#IfI1}_ppWVUOr=!49Tt?5VegP!AGNazeEvFk11=NY4uaonC`A;TlMFQ| z$nGQsff$*kLn=>L?9^D^MqH(z-;)X}0?ng>LP5}XktoX}sX?=^JS5V9IT@mwe8_zN zp?=^SNvhaT0&!YtRAO|qNN(Y#1bl8?7$rHZ+^uzr`QY9ST~hT2sY-^hAD$;hB*_5` zdbfJD3vmJ!lB(+C_|(EgdD4ZI?>T9i9AB(2#va|w$`Uf5@BOQ<)?(r#!gdSI> zIcQ_N!a#0s+otG#k%8}*OcBCL1`7_B4;c`2TgMGav>|jwH^<^~p@*pax$V}3CDa%l z!(4cgxeNhI2=UQzf+d2Eox|UagSzH(B&3@m-a2gP_S3djiLUjl`SxuJQRHx_roApZ zrHZ+m_gPYidZ?s169L(`cKH-)p&aYO@pw_{>w;uC*%PIsGg8b?rC5sE1BWO>2co2V zp8|CXxFJV&zt{6GoDBjFUtvD;L+Iqs1H9Bn3~7`rc-T1^E=6!-VZ#Fo-qeR(3fiLL zt#-+)pKEo#J-sB+LQM;h=Qk8w$`j=WSWcnmv#7^H<`WBX9~O?LWv}sB7P8%QWl2yP z9p#CHM%j%8zG0l?X2UU)f&=-$1mQ>y_zgGW(A9AT0Dt@z55uE052BDoy3Gq39j^=B zr>+!(+^fN{L6-Semc5YqsG1k&*_5dr+Py|M*2-5nP2ghl{?oJ`u0{BmJWfmtt6CQB(#4}Od;oAB7WUZ%PGnCo(4~>Ac&hX~d zs-fHS;i<*ZiQD@@2D4koD)kgs*{1cuq+a(2Y+dBg+8w3x-aQTJ@K$`MR4*nODaJLOG z3G2CkngqM($mA%1Nw~EBw@Glq{L>^5|A$HN2bcu0zng@SjsG+W$Nw-1=>LmJ5c`)& z$gI>S%-sykf6c4~xQ0+vg;K^~E8CV+0AbO`&=ocF6Xyifgj_VOkO~R5!nx0ajCu4U z#jIJkFdDB4j8_k|M{Lal?&z65GjW~JtoUlxz-XvE73?v}UYp(Ps&*=|D0mP#sQSIg zF0~Hb$o{ygr{_4(OrcfYCFfpKeR$2>1wH=?cS)O9qu311b=(q{F>v{jnSQAkVjK^>V0?aa9c`rZ`!kU_NCjm zM{1Wq?&E{UbWne8?`FT!ht-MNcQ)VdhfOoRX1KaYqr`H=qED8}mdl`NWm;L}DYxq! zFwPZvdQT7kwX*O7_;+PtxpU)ZY-{9H3BP>P>H3160%e5X_jt?x6#hSA<2$PbwBcX3U$zon`!99d4b_rF^cFpB*oD zW-$@Jpmj%ntz?2d#8u*QE=Zi*;bE(_70f5xP@@&DvfBCVr5KqPZ&=0i;;c7GpzU{OJ=-HeC77^KYX31Dts~-tdyNzB!1cjmMGW zUSgV#+W~nJogAaXjfO5l?AwcoSAdh4aPCYWg|F@_wN7Hk*f3*}7e{1n$Dcj{_2@1-amc9ekP|{OREi)a?FNilWH{34lKtOzYO`x``hBt)$Qwxqjj6{|qb?RQ1B%x!pb$&5E!qo;f*vf$iyczy05d z0w2x)BnopWeg?|x+)Q0~;6d?a13X}G~i2}XjUqqoV>NipF_#07JQTy*iLEZm1QHaO+MHHCH z{!SE3{vryDG5;nCz<&^hpF)2U1tHGA5e1F^6QV%%Z=zsD`8T4#{0C703<3g(g2ms7 zg1F}2h{ECcFQP#FZ=!(kZ=!(u?GK{h`%j|4`M(eavoNjcP9($GUqr#?7g2DJ`$ZJy z$o@qX>V6Z2Tg6L{$E5vN$yXgAfNmXq5xI%KZyd-pG0BC z;t!&Lr}Gz4u>RkO!rj-xacR~2@bXN=(nqd~$sFU?J~GdOruOiZ$FZf%_S_pQ6V_*4 zXYx{(E7Q4+oI?6i`h}c91xo7-E3`Y=-^;&@r=2xqSGsH4JOU=n5vInfLSd99cn=XT}nOa} z=3H@X_@Ae*g`}+pTPWbelO-*nX;IK3#34#FeX(TpvFIbEtWp)Oc{3YS<{Q4HShAlO zV)&MqU?68nhAJt_F63@4kQ|C%;p>a zc9_3kD#}+P!CjK(RW%|eKps1j}`1htu4UOtiNC-?5$fhc~-4b7QL~1oFf$0$<}NT$-X-!!hJB2VeXRZ#FLGboS%+u;$sc_q3RKq`ecC+ z{6fPpZO}q>=y^c-$G(40&x+|>vJRe?_z`Y?_xvK-iNHuiVqD< zAWXT@n0bfImcx*33xqBV;LVA#2QjJmfxFSmB>G=i-{e2wEg$jCPWAJ;yRT-;VNwon z40*BPQt?09S^Q{kaYYT?Ee%vW7~K)bMW7gRnqB0OI?(Fh-IN#YnQGbw&O&HzoY}wd zVa~b1yp^XKbew$|Uv#s#7M$m8z>vstHU*y@yEuUu$kx|`!gIbN<;T~ULN~0DM)zgn z!*|i=;Q-0k-MDMK)z0W#0_?Yz=jMk+=YGfi6vN7f4=vC$WV!^P%Qq9_WjEwyvGlfr-wP3v@N=h0xy zBFCC4C^eT(v4PF#DgFSloG3Xy5XuQ!8lYgl+A`5EFYZIrotrPu+}D6)1AOqJCB#Q! zQ{^-gFSY;)WD5l<(i^#urRA41S9XC@KG|&FXMQ8yJr@|^*xDDOdgMhWylVK5F)>w| zMow@Wh^N9UADKIEO^$TaUmBbCpfhwmSR|O0#uU$|uhuwrB5s-nsa762OHy(6fGTkB zzk)aoD?rvBL16@-TEBzc9K@JYuygL?@|ENte`k~oNs`Bf=g!6K2L7Yju*MnqXS3m= z@VuX{r2B_ik?fbOL%*WpWTQD+vBn?s1#%(B#|w?jXpf)oi&dCt~SKd z0;&yNM~oCh=B`YVjgW-KbM!H}n5gG1QSVWS3&_c9C$~AvJCcq3rz>iNehH>#*WVJa zycTM0?w33thDDui>}%=l-uclH&)Zdl*GBeytZj+xA54F8JY{Udm8cL!9oB`)b2N!y0)cFeMP-3 zh`GJscV?moXA0sRAlyK&Y?POnsapd8E}1Uppn>{6%!ID zaBE)V+z8t<(gyk^wtKT|m8sVFm~leV6D{zk(R}XbA>##nhOtOz<=QTk^k3>h49bD3z}MweYTDlQVNT{vmapxwZIzV3FZxkoXJC(6M;?F%8&SMXqIpHwkb zjxx;;q(kTG6ZLAbI4Gx1CMe;&4`{>nNHhbho+k=YS6^ow5Lb z20*&h%4^}7-rb(PR@r=SaO`wdr=CCh2zan3oFZ>d&lmmTAa};XYbqvyS zoLst8E4Y+j6}G$PSGNHc&}}FKbQ_$-Uk&@MR#y}&Q-rcRa_U;uaz< zFKg`8&=prXbw0byDB)b!taAJMB=z$7`Zz6X+nLy>>eaUZhdvOxX_u?M?r+l~V+7cJ zGvs72<8yQF9bG(itvsLnx#4^`JaxYRM7R$zW2AkHvIf3_TH!!awyc_7>Krr=Qu(fP zhn!OVn$Xuw^*l+NOEKB}rMbxna~%Esh9-S+GMTVP>a(Qd`GsCN5}@0__t^ADw;|$> zZi70uS^V{VhXsAAqaQ7wLrFP%8|S zTLaL!(IwaB2QKu;93oaD-7x6tGdrL|ZT^!@5Kp#EkLl&cOzcw|jS zd}e2#YloVIbA<$6X3j%n^)xR{#>Gpj_V;`;SdtPu&FsDoRh*@TSgG1V3ACKBYWUS# z)cSF>oX`#YJKK=FZSCG`*yY~XrSq;=JEmGVws_ura;-(Rn1Uh_l3Fa|kN(@hLk)*u`x|D%ja=MuyWmSF%U zBt<3(6KAEXics4Dn9Aqh)rMc_L6s%9@8|5UI)mks9$&w)WSiko}4_F#j?S5N?wiA3?vXdEP?$Yn?X}%9uE(_!xs#Hog=Z{c1KK{w5DzDxZbI zh!nE-2?IVPFMG_*l<27wS9%Hai4!q1mlF9T2?`mpT;YP%P$hu^Cww}25D-k*@9hco>y>9#oy{P_oNyv?sBqTG6t`@T+Tq^GbBTd`ENxiK%%M^CO@R8rukskC=|^XPc5 zfM(Q%b|JEj=f8fvq=RM34_bWbSwaebX?bhF;+`JA;hmve2OrvJxI7cb)QXwPf0 zB57nuHDw|q<01I&^7=Z%yz81B4c9FG<+05*GS?YGkvsv|yR|(Y_B4j7z$&hI(&8qw z5%)8A7{6{}!lm|tPi>TNVhw6!ndu;sf%K=+F@+MO^jd~QqVW0%z9#eP8P0SaXhRzO z1RIe5_6~xDZd84~eCgz9R^0`joPF}FI0E19m{=C^CEmdNx{qHVk?W3Q-U3UH5r1=a z^kRjXRZ}{N9Hu*(QQ2d{g8;k+Hd#a_FMB@$ikO(j^QNsMNyWedn1CgqIaCFxTAP#U?(Z){Cpp%c+lovzG(G0VmNp`VZD14`>}M zzF4>%(Mq$#(^s?k&>Fx5+}Nwy6`+AuGq?W;>;QV`MZ79nu|}CsGJN2co(bEaW8^8a zSU^F9a+6h55zzDwb}t5Y6?IZn$$9f^DvNGBcoba>!kl5Z2;wE&rr_Uz>mj@P#2Wnm zwhlTG`|eH~6GP=1Ro(Al9E*hswRe|G@h)AIq1+7{l+o-Bs`(`GX-#+{amLAKgHJ}u zXJ87SRzvM)>aaaW3;Ag^oO4kAO&xqDZ_~lnQcpO;^cm;|Fg=RuJf zbc@M}kUFI0g#8`Trb7dFnck3-4!^sT!Tg09=sr6KAQvMSQuspR<9PQz!f*ZvWjIu0 z(pVv*YM8FZ{wPn^M2XV!#M^p@(a`0EDC+8r0vXDX30P#M38(sX0H;9_8*UPiIamY) zU7<8ebTJ%j`_BkGBSwjkn8kA@h2o&VeeH^86cp|U0fknTV3h^}f)*7Iy3OVF2Unz2 zlIQV9Kf>j>`q~F}hprgP>5r|b!pJ5PTaq*{cnVcbSC$PyBPLJAxAs6+{70CDKjw)QQl`cR!hiHT^9>;upjXc>{{`{6?eM=Ys4-z-!)UIK-}=|>a_h9>?Be{p~n!h)(F%RYJ$ z%12-OZIoX075;-A2s@$xIgo&X80=I&(yX%zX|tih{#S?Yy?2*xlZfLLtnS;3xKz>b zB9(Rv(+;=HY*v7qAOT8}YVR6D%Gi9cF_4>UWgbmrL_R++KxtU>`-~hOvyno3J|hQ^ ze9NurNvFHXT`+@zSth9NaQpQG&^VavH9$8HvBl=dG+= z0vd-5!Pi#}NdonGwBG_O0>u#4%7pUs@x@KnsZ~M=;d$xVyb3i!JUr&zTft{wMX$lz zr=-pI>GEJ1&0Gt+*p^6000cm~(F)nlE743Os(uo7{G@|C z(@tRe&YegBAkOySfRC3_2^&i_WJop+d|Yv;Po2RT=^vdz>EF0P_@Pu0YV`Zc zPs#0|Us!C1^uK&<;5?}Ghim_d8;nPKpUWBb^zRnU0u-&6N&`ymAqnFt%FlMuzGOY+ zmE#wNQf{C)8z2t%@t}Vj^^C{e0kjRw0Gy#dHh_a{4$wAC_9FD#3h5B;`|1m6_=WiC zpSheV)1w$;DdcHU>uO&_EF>Oq4?DMOmKl=rYW>VySfc{1dWRV8Y z3=W@VL+#V8h#VVyG%kRmslrY+gWOQ>+<-(jyd#nRRVEhX+AcYn(0lEfMRp+5^fI zj8%4PUg6E}=E{bOUsV|DP_ILtyG4DZo0(%pD1>W90A?f%8X|A0${ILtg#_83F`o7(&Oe zJRYzN8(rfD@iF$S5$t$sO_Bc18LY9M|K~CM%^CDzb#^2J5GPP1unf`SMhVFjIKw%7 zsOC;dWl3?MY;4OwezScvoA`v@_{11KTLy3rN*F6(0Lb7M zna|LU3SyAQ0jnIpyBL^S{wSU%aV0AP1`Mzm0zOj)Fzf4ae?j9xvao0@85CfJw7Q?6 z9FrU#3$ZE1!ZIN&B3D~6!6l7g;zT$mOtR&qi6q)6$abF+1JmD-!LAWpOSOO&+%2-3 zr@rFI9^Ebm94K7hqDlazu3A)Rq3G5*ZJ0f=oUwD1xc3ucc>V(ffEaEoCX@jX1J15K z|3ZVg7ftaibRYUOef6w@QBHTT&?XzBKU`}+5JDH-tS1Ewy)g8bXJm8CkXHdr=AhhuTRX*^}SMUp2i?X*{w6H-F zNqOdztG^@lv?n)k@a2`OKV8yoA_$xsItgwyTFy?Y2o0hq z1qhs!&x&EnGg}~e)TdMc-CpL;2%;n9^52TVnD01u%r*G&lVMOgUp8lQtKkg=!M}YC zAfx94HxMW1f%W_D?2Xl*uz67jrDXfCOsu`zxKWQ|ELHrAeTpGo*3I32_~Pm{kS^&B zD~PgGlX=8h&;5a&`X@^xa9}2XFml<9hWH<=@B_xhL2_C_f&`RjSe%si;vgD>GfV7Q zFy`!zow`XG)=p2tHJ=xd5t2@Cf&8ENz4~!hOBdFe?ezMy94c`+wF;^tw{Ob01r&cA z2hmYpNa64z5)X;DUkh9Q;E2Kj7zQZ6sZWNXigxfj`67gsC04emTSIr_UV4=l?Y(#y zJhu_OZWBIfBMZfU83wh5zZFAt(>Z`)F!)5H!@qR1D@23NGEU+x;^QmRK$#WD zziv7@m9B;}SJc|HSZu0hTC_x4pTE18@j(A{#4%m8P8xc?JHMM1#yiL^Vf00N zff@5H11%zoh25e{i|C6gYpdN2De7u_b^p{ri;R(_fM6+!K41-UbyZ+Ku39<#o2dA6 zIv`}YU>0Pwf#`}O$_OR$Z-2B1Hw>Au575^VZT<;k=2o`#T*t)Fs;cSfN<`8&1qq+G zxQ^Iw#0Fnhm`QGEpAnKM?8ze9yfo+_as!UNnq1xQZZC?|+>N2ui!bGgNiwD{zXOr+ zNikrPe~>_(EhfM#CdWBXAEcEXOl~Nfa%^sJyTwGR|BzQVt~lK#TGA^SWu%K;Qb@l}X$T#p^4(1=(S z9R{SHO2F%wEH~GHY8De$swq>0tbVz#h=$nYjHwIZ@Eh=mJgw>bUyY$YE;D-J8hUCO z3dO$U9^v{6c)JLVB(BS76lUfv5^crF77vnsd2$BuKDr3C!cb7|xtjtzlv%lIKYw5u zC}&sc`tWy=$p0s10P0SW>I^sj29ye;P!*Me28yFMUkM&)e^lvN)Eky-0MmE#)ly-J zfnx6VYlrj@6aLk6_MB#Hnqa5boM>Wfk`_=;wYEeot6>@eEe$%Xe>P=9L;XPloYq@f zNkSZd_Y=v!NzXCWAxWJONVc0`uPh@#W1tG3T)CIA|!oLiY24rn0Tu+?{wE}xT?3iq{ik&ail zOAvM3c>UWlaQ)LV7;V2U)OuUkbA51BUXqv8pr8D-!T;Mb*dSi`&L%utO^Dh+P*8ZK zz!7|TBCTET-CG-@4~t1aHX-j3b_TQz)K5i!7?}hr4*)HL;&zp?a>NtqZ5^|zI-q6X zBrp5IR6;f0IhYlA%#2{_o;OMQ8WzAPbyW;j{!wFtJNOr42om3oAZ>jwZa~ZfU<||n zgdwuNctc!#9JsRbWC^6-l(5wJaG#&j=HHgVCRTDk-`9jxfr69;1a!5s5mrWMJP*un z>3YnlO#uCjW<7C8r$KfE&@zbr#Tb%B3}!7r0WAadkE>Y=So-~-V1K_kNiJYP|FC~r z2H7=MK+Eu*RhM&2zK3riYBYmE-9H7o)Aj5CNT!ZcjD`Z3ZC2$yEY`&QMbCvrcfR&CwoV zVx9KUGuY(6>=CB0e;pF2t1iHUoQLTDtjx4UGdM*8U<{A|j6ogHGNgnX!j_;nm5Ub> z{j?DAq8p1e@T@We54|cccmT8v&+^7uY6({RX+)&|VhqTwlITPB>4c+$O>p4fredAs z(L%4N0!!QMMZy6sL)0AW;x8i$-_~}`&2Qg+Gm%29-95ur5;)=no@eRDm)jQjfoAK| zj!J&T$qyGQ7Ys{jX&ZDqMo2I9j$q6jwc8r}|y9R^?&rfHUg_ad=GK@kr%TeJz1w54TN+sf3HsYWdP14PM5?UaL%3+?3;BpE=1{F}nm zBpIP_0-J)w#9#i68RD4DjPj5byQ5N|DM%K~{nQGTjj7DBEl&co%OqtjD`9G8E!yM5 zO|wzpl+KC2(gKH>n_-(?_xBD`gpAJy9!Ay;vjh~jBBN(hXaQn|2B;D<>`4D~N)YwN z$iEsx>_0I>14f`iGeBd&MqKH4JZq9ncXM*uSVAfm<7`(*W1)nRD9%z;V2zJlH_oTD zoyWOSXr`8g-3*WRRer`45x_d4SXID2j!j+AYpWEif^9%YO#rzaiFDMg8We^?WFjUk zP5TpZE@@t2{9gPuUa(wHiXTm)=v@puFG*8eqA07Js^7vFAx&8o0u6lKu^rOXVl~X{ zQG$<9VIEf_iWQ0^D3Zca(nK^qAw_ZW4%7~^JKVf9zFrfXvcmQ4Z_E(fq|Eb!CQbi8 zF+;DEby8ILICJU3STzB4lnQcq8N5;yAQMDkg1?XqtdMGzUWG|WR70M6rnUjR%omF2 zIdu3*U`4I1xI+DbhV2{101I=u&ZifPFq6GdQc|#)=3NsL4wN7pbfLN#Cm?dX1UfEr z+^-U@!iDxZ9_p9$a;sa*uCf5290&BIi!~CvNU#8m0X`(Hg<%e99Nv$@vF~-Z^BOv# z6618&-9)^ZPSVm1_3Ssk;I4g9!y7ILm9(~uHHgZq0_x1uzZiqeKNy3>C&q9rWp276 zZ{5D7os{dhhT&>gUWcHU;xBLu`90R?5gZ9=6-@A!_)%k07SzjdH=vmTEi)f)Ju*z5 z|FBhn@aqsn5r`ksVXMx*sozvT&onIw0Aql<7s|t(hb&mvp{izTb++shYm=hJr&;Dd z){mWz2UQWW636`wK{T!^dI*9k5?%U2qVa3&WzeL?cOp@p!B34Oy@E`YX0#dNg{c7k z?HFJ&^omAJFmZAT11yF?Q3p2oK;;p|-tF9~hB>$c(#%F{khxtQiqe8q#b-x<(R@Zf zfW-jvnKEqmsRL4mH;E(`!KoB1K*}I%$8_aL^}*?s+721ISLur4jCXZRQ#0~ zq5&ZTA3$Q@&80npnu|FfJyAsZX7Kvznjwt|;^Gpey-QuyPSAc?77<1PkQmJWl^85O zB?hqnCuFz>NDM0fN(|+n5<})fJT)L>;38ifOh4Clo0d@Mddo;~k4JuOGACD`0)z~T zn4`~Jbq=WROvf}qXY~{=_ATgiEqlF3KdBHZe-z|L_I@d5@Q3sLqe+3{ug0UmXr{(i z$JXHsU2xcu7z{@5v71ax$?0evm+0(9h@6DpY8=|{)&f@jF}LIGLjeZ945!-`AaD!w zbqcEtJ$^>|cOBu`sS}G<_#)JscPi}=+&?8l{r^gaen829S;OczYs&|1L9Ze2q>26d zzmmc0zZ8SmUIr^S)ke~;g3%tlO*2&9&8)}Z|4A{-Pl+Jj2F-fGXOeXK0UHKtp%Gx* zSFd?NUdOdFZK2UYlCV!Pv5au6OlJMfa(26-)|l8Id)2 zbx2Kw*cXV;dNE2vIaqb>#??q-qSriGD5MLT=Cx;Z4o6;O^`uj%)MXLmWg8{k`^Jw4 z8FQCsL7qJufO0CqC0EM(t)c2ULA5!OfX%>#MVAK;~xUY%Fu?pGO zxjwMl|FjIC0F2>+Bnp8$b5Y-K5g86^JX(1+E*-;n4;T6uwprx4Bvg02eI(Fu{R!FX zt=L`R=Hw5MppAmf4Yu>QyK?XK8$+l0RT`W30`4Ur-I=k=w|YI9Zp!U&9nUZ$-w*KC= zKlXU=;nCIR?s9cjv+mLJ&iUpu?sJas9F0&w?}~&<4PQzB(cw_@OlmvQ?%}K|``f)` zJ)^=!#G?cAlIX*|&E=8rLoDRA<)Nh<##+^gWNqbtC&bY{2>ExD;>UxVBX3-PCYbc-5);xc2*49hZK)y%{YTv3XSEyVK z?OscC@395+5qw3xvZj}vxS-p5HOfPhRLYw?8V5f6ltrcw{)vNoGUN~w$674LbglRD#&BVC(h394l~YwT)TI*b37!% zgC@m2drGVZsi=gp8M|Znl)xLhXH&AW+qAQQy64Gi@>6#=LIxSuwkGp-;iQoG@W*>r(e>@>yw9xB2ngx`uv<{lQzyX33bZzN@9j zYEZJw-Q%I-E#QU0(e{0F_kH;gyD~scu(^g^ZMkAp_4Wn+=nJb0|Q=*Nbd>-adf`CLg^OxEbAEhkPBoyflUB7BFV#WF?!k>swB7I;_24`HgPsr_aOPZCl#u}Mw6HrMy94HTJ z%b04HbL?SRl9q(GSonK7EPS5L?k+mn?3=?mQ(X~adOVM!w{-bx1{l*1g|=(LCCe2J z_3mDXFkYAW8VQERsNTbBRZte{9=|Hi77w4CJ;S_Ky7bE3jGr9VzP;|eZjrq^@HO4u zBXWf=JKClWZSc6<9?u=h{k87JA=-11cg+PVT?LRiJ?VpM@T|0VS-<%t$ zLc+*wUhd`sLbjKk&dzSik5cTdi5@;4?oY3Mc6UoJL=$zlYTToUD(z(Ww!BxaTXqRO z=nDx3o6sdvzZFeFsOy~QR^4-4_x)dYJxD`_*zt1d+1Z z#B<3Feq3XtYRbMoZM_M_xhOf~HJ8O2-1=<+BT4POU8d?)2+*9>M=bfACmyc0xy(Mz zxU3^Vt>w%^KAM^2_QJ=x3{fTCS!tp_uxK5z#OXe;G})N zYbpOd%i|j()IUL`m<=&6((s%5aCir;Qm?1GWvhBiXS=g!IRovj&#FB&1^WbkZ-`&k^ z3wwL3l5KO!M1yW=Tf6B6<Tr++IT!)m#%vpJ z@s&|x1^H@AwgVu-b9MIV(!&WNKQ`#OL6ODC*8$Hw|66HZI+tl&Z-NHmXKpX+^u>h_ zi&Nnm>p3^aIW7+;$Fb*PTU&c;yXOE{boaOOM39d)w@1~^?$YIwl#(Sx<;w|Zh#1I( z6RWwbnQZie)!gMO_p*JPA8grJl)c^=nvt8$20+`4XqD381}>_%n9w=>(WC85oZ$++SiEiI^gY#!UU*PuB3YSgN(R7o1)7(7_*(}0B?iN*j zM)`h0tAnc?Fb>Om{IT<>M~s+=tW<>^8fA-#018685mW=DDtAo3oPnv&6*|9~kYLC% zud*H@Rl4^$R4R|_&>M%!7t2eSrw%>kzi8n{c}th6ttL9J;j%DK4eyl$s3d~!8xrw^ zGsI$b4`R{+Hxn``c*e$B`8e=4yf7Ufl#u)!@<|=`$Q<^_QFAE;cN5P{0}S%2*zLMM zD+yjW!#bk}`^c4iPKmDHm0Y-dGK}b3&PlY3TQZt)=PXhQvy5C*KS^dIP0Sd17u7hv z8IhT`i$!fb`BL84PSRAowaLuI1&5G-=-!$bd_oS_;ZZFEwcH>1n-kOWC)pvJCsvHO zE~vlCeN7U1E(JFVz8-1D#wGIg^m7#H94Uu(k+gX^L7E)_*`~w6I^$`UC$!>TCKD9$ zm~RfuUf=}};|WJZ$1f|II5-*b5fuwBUk~N8XIlas2L;O0lFcxH;}Bo503TD>MTG5g zxPpryI%LSg=aw%6hAW%=z5Ah(>*U^K$jFW}8=(^5I5Zrt;vr_WW1eUa<7GdE5synX zG2mvxnY`x`5ZIqH3MxLvheVnPiEG81Wp=xB=2?;5$!xwGdAgUM;$^fCnW;*Lzwfnj zVaaxkNM>bNr2TkyXMULPuCg-eDXBhS(dkTcthqFsFo)HX1KE_ws9sZJ(0ApE+`;3R zNkc9ruCR6~aSNU}yg3qBO?%6IN&lyIbm=Wakra^lgk4S=L(i5N(4H6G-jFXK~xz;~pR~#kMOhl&hT#fXXzDAB$ z*Wl7t#H6OkdmhSYl#f+5-)Tm2B4|~2@S0y1<0C87F<-14ao0h<} zBVObY=*iTI%T&(tuO1QSTCDURR+e&lqBnS>KN~R=FHW!gu+)khG;&!NWZ2DAtf{0M zwe+?Nr+)Qmda!K&F;LyK^7E@|bw&PKi}K5xL2(JK%Sm`a>p=Q+h(`ea(A^6^-zD)k zC;Z=i=3fGuy6bqbj!VnyyRRiB$~#`1{5q&Iux`W2hX$YD{N|{>9QWWl$wBbU^G`V> z-Q{$7GS&4E2=|1`-gt6SlLgGp56K19!^FtfJ;7?kQBfbeXXE+L02l{1q{cQ0{U!={ z)lbF&4=^Zg$4DvKRd43Lzx!%*(Buj1M19oStVNTJQDCT;rOz5U?yG%)YuUq5t$lLZ z9l6aZ(rgoN-2#bH+9?s7#Z=6qSELhNJXCn{OKdG0n*@lOXHd$EHKg7jJ;jtkEAfWs z26g)_5HvP?5&gQlM|kT_>Et2A0;aoRHJpPo)FZ5lFVBWd@c8=cbOXhJh9+?8%rNZi z&05nwsP-u$SBn4In3%)JM0DSuVaquBZS0SduhEvb*=D8&*`3@MvLz7-`@ao&)8Wx_ zJULh&wAVYr2L8{`Se{v&C-_1M3-}dEoXW>Yj$qlaBj(Llf-u(wmI9W1e(nm zH;Ldz_dU93-lQ<%_%Z&B7pI2<&)J6x!+2TW$ba^BXzR9>3x67ezCB@Y)s?r&f*knj z%hI?c6VJuHr{%a;&Qh$`B_z`O(0gK~>DwIfj8dd+?{>D|=LXIRpRJc~N_Z*DvsVD3H@dbfB&X>l z^uBSMWwVu=`BebpFfsoR;}E6F^b5UdG=;C`(QP@yhtE{^O{yTT)_qE!V$cdkDKJJ9 ziBb?A#yBv0efBv$=dJq4w5z1-=Et^JWyFT8!113Xd=j>NoZx~cgVDJ-R;kG7ycYu< zD32c|E!}WDatS`k$(=?GQgRTKpNzxXH*X>_?YQh@EO4%m;akOke;5bf-&m(RjCg&5 zw)q!1zS+MSrwWgXJx@niSiZiJj>TS^7ZCos$u9}K&BD4VwR*XYZ6zft`fOE6sf6L~-Zv)E0-Y9dGer^y(>pzk2u=a$rwCKsM67 z#Z1_1bDy#NQ>c;SWL0q~F2UURbUxp6Gn@GUELT7qWOaW3SP`r7dl`ALgzw;*ml} znkHe#l#M=iQX6t{%OXjozIsAqG7~;jn%adWm*}KDWNYbHqe*z%<{8+ zH3;8%19*D`&rjJpRjvLu8Ysw8%ZTgzwDh{Zc2)X$qrii+bcPo&cVjnI#Y~-Ycc3R~q2fU8Rk+c( zQ{jhwA``C5=&I{Z#Z`!nhd=q|x8=LTr{6ju=Qv_L- zCw#IZQKJTzfoke>gc{6yQzt?nS1GXMRW&DN?d`6~(n30M5F7*@d=SISIbGRi3yjyL zyzE28-jRkrQC#>yR)l=Hs=uO_C<=MF(Zt2D?6@nGw6+%A;HthJKdrzd+fHV zlv;nY$U`|kpzK5W3`?%Iww^BGjLI~*eTcSvvokHfI9ru1>^h~C0rRWUC{T_6Freu$ zzDTL6KO(O@NLLL&IpkmhCBVJ68Re#Sk;%s=xs%Pu*M3IZTHh*FqrUDd^orP7wNUx5{@*tH8txZ4#R!ilO|7(#$)t~8VcL)U22p=0hB|w=f9ML$Ul?= zbp|9|X)KJd@2!8UIwS>#-s}t6A5in>?P71@DWEdKw`<)$L9cOm@h}Qx4ow;#-QAwd zt(_WOWnEHDY22@}7I$!j(QE5@kMh74COee@`LubrL3o2i(H>s(Xs?0K+u1)qh9MSa zPVz*KTNck$PX^{GBH2yMAIh8^h(=GVL}*$Tjj5q*Dt=)YtQ(eO0WIBIBoll6$+^6XJNC)8Q$4DclMP~L#g}f&cQ}CshS#V? zQV}d`&=gQU9f#DK`*bAGPLs+!VB3nW=K%hy`!&SkdQK@mCjUi^cLl~z#vw$(X(`Z% zx4eNs7^!sn8nG{H+>*!KOsS?KR)se&n>aQ#RSAhtGM9ic?GYYCEpcox9&rVbF=%P# z1~8>@oP$FFGKVP2T;8Bde{%s6wWX$c1DiV0Z)-SjS3h_#>RD>C*)t4%M3l9tkyTsSkTB;e`Iu|28N zNi5cQTx^tdKebJ6ylIN~(}z3tCU&BaXr?A`zO$t-ZFBvYory zP==p|15`ANX)zt)PwpiBUi>Lk7`AN%-Yor6oT%JPckJ}jm_l!Ve!bhbfKc_@5pO}| zTgZnj9sNjQmgU6ue0v#A7WB3V2w(u=@TCMYjkm3rAaO)Y^Ir4EO{g-M5B&*p6?n7K z6X5>0X6oBufmn9?mIF5t599;ad124pLR6syxnfPUPM4dI8NNcErdo2^|3x@Fc7ZO$ zVgm>VKkd;#y!H`(etdL}Kxwig@_GnT%t?M|&FloXR_1rGahOTY$Htp9^3lJ7Lv+re zs)Aw8p$0N%&Y`vdTF#+L**VWd$DSk4d{;jK&wLxv&L`l&;Z|%}1oTImT&iy?%?2Z6 zJ_(UZ&&)aUlCqE#Urco}<>yYRxtVe%xC$Y}luANw1fe>Z*BqOp&p@Rz8P9}jcPd8*qveLNA8v7A26-8*8 z%G6w$@&E}q)CCE^_HO{)PzDEaBqdMQ)F^xvYfck)d1l^ z?nku_4_OYcIq(@{83c5NdQ4DSAv3VIbonRT@b%7HZM|ZBYPH&Im&Y-cyOPj_eQqHK4(+?LmO1NQD0(Kcx%e^tCNz>8^$vF!5ta!b$0`};`7)J6E& zU2sU2$FGTu>n}Q$zmrtR9ozUCCm2HR#+P?qLpar@w*6H3{Q>6|g5n)?NFbWZf>1jv z$fV`w>x8O@N?_1g{K&!}FeLB6&i0W)>CgEK=OJK(E%qw#_Cxp6=r&L<*Cn*0)Zb zI4~bz^5y1UlE)YpQ6R_xzzr9@XLCiKo^nuw+j5#GFn-#~>PP;&VF!4)3BA9=^1dD5 z5prI<7%&H`@39Zw(|n7$1RZeMc{x_hp}!#au?lGq+xOs*LV*aj6(@;yRl~H~fckVB z4gqch`6b_9w*jU{hbw#`dC-)fkm|!^X{h5jp**rFFE7-RVy{*wApXN4kmWR?S0P0P2j*6A8w?rTx)Lo z5F4S=V^2r>1c%J1b-9!JdtlDW9|Hdw)5VI|44^*_7b_Q@`AF4Bslhuie$pFfgVNU+ za4AWTK`cm>hns29t~;~_oO^!%Q5)n6ZR$qhZZV=2cC|XJFqJLBzMhVxQ3ieKWC4?C zaxH5`K_F0^^K{}sXf?d!p~sR>_!n(p%m@^RFo`#^ct+Xu@ckBnTO{W;g@@tJi5NAR zs*Hh?L26F&X*MvLd9oEM&I;xdNKE9i!yXQrxg8F8h>FdeY1#IR8+dJ8#nQTFgm z0|$j8u*OlibVCJzx!OPgA1@0eElm}npkFc(5l8|*!3M6-f4~Mx!BhL7+5`Q34`oWQ z14b+JqRV~s-o5M)|;E{Uv$^cU(1&vlJte!N3OZxV5)$`5HZB-;jyY@1)|*0POOZ~cM0l$O_a0% zKR^oN6yrmcwR!1Z!>xEe=aXkZh(+UZcvjY4`{M2I=FM+sx|N6|T%)giVhuS6$-5q$ zUu?cP+(H3qGT9*6QB?YP3w#`TSYI`=8rH2sLOn+NjB{ss2?hC>NPpKsg&&EmOFi0io+e@XF`UZHGnoZ@B>lPq9D?=NYJd_} zOk?JY3&R2NBC>#Tv@5k%$ALi?0c=JLa!m^u=Yc}^4JW#WE-jZwKu`&tF3cZCNk-lx z5(b_Kbc_oSCcjZM&m57q_K&wMV|a}iC<-Qg_^naK5{>TN|H^iGo7g9*Le^(qsH`*2 zn9NYH>m`RHsFGqINhVBU+!Qv0RqKHK zSStXn86mcX1;Q*0JX>@+-#jY$n;=-lQaFK(r3xvA z2sQ;N5R}6Tg9d*;vInF8-4})E*$cZQ1)YSk+JGuCb&2DGS48WBg^IB(nkrSjG+4rO zj}z=)r9pZRDOHdpx{of71I(R!k8Ls#Sq=CE%MdSvAAmF*bG6Y$jT74R$72mr5Mc{S z@5KuYlE}_}A6&u8>?MNegQhS6f?)L!M**DXlTA_NXDrRqO&dP3o#BOfny98KR`;L_$rdgmt=N_Qi1{x#@?z7 z?2_TL&a%tx>^tQ@6u8&i#ew(j?MYUv!rEI7V3-B4Rv|%2CKr+$5n}HP3R`^8~ur{InYUMM* zsm87>1f^9x3nxijONjh|06c>L$L=eJKbxDeKpvA}g0NU5S(tC>q`J8qHKzOR?-XXpJMRE~K_W)V{(`I;c1p?R%&x^)X0GlDomVw}OwUHM? z={;}<<`<^gF-5(c-awvB29^MXwgFIxE~XhTS`cP_ApBcsV}y`*MAb{7scXrhiNLf2<0vDor_yaCNa`zPiCF#F1!-Q+9 z--rqC41v@E-$E`-Tk+#QWP74zWEPKnP(8lmtP!`+D?nz*ro2C6N$XU@7xqJRe-}td z$?<0>Ovn!EW#r<6+a3FTuO3L*`f`R`ZL4Xc5miq*f0JQ?B~il7Be3u6>MfWu?j6~W zrd*Zwy@S5%B?H|YXAMYDmS7-s;TKJzE1Sr5s>NOc24SoO^c#4Tl+V0ia_wCcoS8rN zjLwz%Q8A8gH_}Cqm*003-5vsk6GZ)5akjI2HrY)~2D8laQMnb03ZiFks%V8oSI#|{ zus0Nl7?JVoxF6m>*InU>g8?!_V6Vxi%&>&9SC?P`+RO?kR{%Im)wG*hs>1Ln9E8BD z$E;b4LD9rP`>)JEeOiuQLZ&dH=?st=7{sLnr3!EXGQ++D{ftUM|J{_M1gnI^(xhKn zX+pG3JLiJcP@0N*i&m2jwQQ5t2%ED{*FrX!IcHSEY4f<@oBLhN-Mxv&4}2-W*v|dK zI?IX>kTkXwf$=pzkW$be@w#tA{b=L1BosVEKp3}CdTXQ0ORa4dp$rR8R}f|>-#7{g zo;|&QG+@dIR#u!wWo(-gk|g5AA=a|oYs-J~kF=6fGvN6~45g(PLA?`0+6^0T#6V#i zFa^*VS|SsCPy+8x#~>&t#JNnbCzb6@Y|5E4Z2-rjVxpDo6qWTVceco9HA)9qm||8h zi!jS%NbImATLvyNZ28^aE)pvG@5v*WwLX|x>!Bf(n6Zmw3e1WxaiV@oh$`K{9LDWl zje{^Nj47ON$t(V^^|q}T9{V$Z3hK2_EwQeR090KZ9K6a*Wh2);Nm3rN1_ zAsyCyfmW+TvIK)}Q}Td(iUQdr!XS<2Iv9qPbq`HmbiBlaVo;fw^8FK@pH#XhD1YBs z`UQ+dh1!6ie*qW(G*|L^YIbNJtKWRF@nrfp;5_7V59< za?#igtKJBJt1Z~Yi|iEm8{#PvQE>eHtW?*6iU|+p{W&b3jOsUX!<~|?$M>o=O1>i% z=@k6+87A@>%$ocN1?rO6UCo+;QvL`E_4S$+WdRZP3AZQIyxd@sU*Lf3h1cQGXBm}l zECAVvo#SHg7JF41enMWWU~E0RBF)l#9d_Na}OU84Rs8(lto@|1ot>fsuuax~^l} zwr$(CZQFLzv5k&x+eyc^?M~9MlT&l9wa?ynbusF0T#Tymz5iptJ$4qG;>!K&H1@#- ziH`OX0{B^!$y!5!E1JnY65un00(=HK9qu_<@y76_XdQJjRb=bdB7qFEKTLfZEg)iE zD+?dONc8>{O|#X~ZFh1>DF5p-KvfWdBdhoR zInTayWnmZ6)33eB#q-QU0loJ50@py|ffspJV3JnvSQr3SY``!pMSx!zQf-Q0@0duQ z;Jt>Rs8@bhiuH%c+PgYYm_OuJD?cJuv4uc;ux*7TqkXnVf6=^N?P8Ud1_HLlsGwpk z@AS6EV+22QB1uz*KNkpfc}&yyOXJmiBZKb*vaNurtg0~HI6*G;KB4$)+{qwHOl*ku zKRyF%(#;>W94dz0f?cz4mgMSn!vFXTo4+gpIl1%uqYL4k#N;sQ&9SfLcH#rW%(3uW?JrP!C7G-6f%MiX3<}A(N3W z_rZ9UtM!rpo}~WEtDQ9t9Z{qEOG`wVBYv2fxDc7#;COIoU47muU&b3n_%~&UchZay z;92qbeFDNAo%~nQqvde}a+5p|O{8NLx`rGJPJuDV zbUJ_j3p9+2o2#LWc51^8QRxDJhFC~D@X^G$w690YeoliO5kulWBl&Wz#3?cy;4?%FPwQq{ zL7hYhp>-JrSQ)&9No&A9Iq|cS>0*|)_C&eAAQn1xE^Y)M0HagXm2m{qd{;!Beg3b{ zK=D65L+gKhhR4ztR=WxgeaAYPc_Dk)9DjH*4^Um(lo?$TOv0mDa(oADq;>Y1W!<8bJ}8;;209gW&h-whhu+}X3YU}8M@2? zT9g@eR9Xx(-BACmg@^z*0MB4l{Kp(S51$0UGnf=}=Rk;5nNsgN&aZA*LENJ#Y;pvj z|6@Q~R+gjo=Mg4d$P@zb48cZXq~o_nHN?zy-z73Qg{QKygv?cC&s3)(#rsnD>Y`Mh zz#gCx;@dzCKS;w;;$u?SNLUUWcT6N3L;9OU0z9;#9$^5T;TfPaRC!ZTDT8n!ACc6F z#ab*QYghe=4C;sk;0!DO#Tmv#6N(7|I0NB4hHKclq{p!vb!0A6KtPXt8EkNOw?y5) zG!1>EotNcNvD6TT-Io8w8QA}WGk_q?moBUXDo)Ge?zMTI`1t~GhN}O?8CL#-Gbq?h zq|Nn4=cU+~$a~cBot0GVe$PnrPe6TdwxHHn%u~r%!kT^Mt#?B6W4omfxofBLc5cCB z=sFv@TBAd*wks=3?8B=9e$EVd(W5~RR{yTRYN5^1%F!PPTe#Pk5e>=cb(%^-!|!U7 zlIiYAjGTnoW)VB+(FIxiv2yAcL<iB=QN5w}@SanXsgISxo5TwFwIl zoK821*ngsD8iU=SP&K#C0^f-NF+S)+O^sR06te2b2W!ostKg}H`#xO@6C&&Q0)2=V z`2TeV(z_WP0`!~7e^e}Y5S+SU^WNwDhyRbxka%%g1o9dS6yjU)m=#%-KR(R;o> z{B}+uA~Puj7~nH_BuhXN%-S>zTtY#>nM=}~OUc6uImd@Rz_Ceqkb@aYb4vi3Zn&k` zy%+l|I-GI_i`*6L{WBWb3oIT$1T%9kGZ ztkIUK(&+3sY^U!IKHpyDwC4rd%6WXd6WY;x&dpA0Yu$SIx<1ue)gK&Q?;0|`ApD&D zoG1P~e{1+(&0IRRS5Gy+_zJo`D_A1tUlf&B&%9r5r*72+=-RJxrZuLlyuCl?(Ruj# z_g3xes5PY&134tPiTQ)QcE$nr4Gz$=4up#LT{9N+xBjZp)-!&HURsHw}9GIt@7w zpH|E-sO{GrcX#dj8G6rc7EC{$+%F*V>p8aS_i7!|&3zBZ+uM5#I76+iKh6gi7BmqF z(tivcHBL-xLu58=(}((V0sRNPDzjBQkLDJNuHA9 zNZjvE=$2ya3LF|*XYx^hH8n{`Jps8A)3b#BP{YfqKU8aedCQHQmu7qj& zLpQZjd6%qbhx-xw@C67UOv|pDn%ZjOK`Xr-S<$QdlPlFbB}QG;!Y$0o@P6t!I4?Rc z9_u*PG~+A}j%%2|9dAWs1-emo(wjnUc=T^A4FLg-&SYSxO2==nx)_RW4-d#I|xQaHtv75R$Z^CmaTQX`SF3? z{M~*AzaW#3$NtLd?ffg4HDgAvB; zFl33_rrLk&0~~%opy>bP2jnKDr~%{u$q$78Z+?)s0>}@b&E7&cwV(b^e(?F9{J{6W z`N3y#TlPwx2p~T|9*{!T*Ie0B?#*=(*yb0!{oSu?7-1T;C9c~H7;;&zs~A>f`|Yt2 zmM^J&&lZ13z9c9$d$sEsw(TXxtNH#k)xI;bQK%8W?9nr3I97=_eoXB-a#p*TSsk_+ z67qY!`s>g23DoNdQ?F6D`~*7IGyGr@1aC5kUjPpGG%k*^F3;sa=v;1LO}up`|i zpF1g)adVOT81<@lu&^^yFqZoLX_eQnetnQzlpzv94`lFp*f8SL0n`o~el!%b%rcys z01rk4$UMPv=b#A7L$O@E|65~4yaV!IxTM#S*yNH?msPq~={8nF@YB`W%j(uj_Z6Tg z@JT5W%#_D`U?J^2@Y*$$ibA`>o+k%HpT{Ez&xAANhr9Mdy4elIUz6 z&CcS5*}ooMT8!br^YYOG$1Hfv4l>)Lg^Keu_U#5BZ6_dIU%#j2@Zwm zixRl#1?1>82GnT*Mhew#^m9#k@Q0-$PJ$;_0Yq2J zii!OhEdM0F5-9(`4hyQspOE04{?Y)(Y5r<*Q-zwp!-RutaTldSnD>_S=UGk;$D*TuHv3@Ou~AKHc`L8R$0^dpH^?;ZIT%K5#I&5zSp)v%tzF0Awcl9!-s>c zpgj+0gH}-Ar=Cv1f#46_o{vkgX53bupOCA#0+?yg#_$IAM-WRCrKoU4nvGg@j9~b0 zDAv*z+*a|Q9%V!cvruD<3%}?}As0@OOEBL|DU4spC}k8~SZ)yGAwBoNcfQcXg3_!e zayuq+Unj!o6$_mvp8!WC&#&fik&R}8SrI}2t2g;_N9Zf(l^A%g;>YKgWx^n~Os3o1 zQq)R$WS2^RX5?8|qtHvRwqWI7(&px(rLgW4OWgPkq!w~mq_2E$OB_fI52pk&`ZP05 zzYdFfD+2rmt>1wQH|CZVZgayoZf#ic-BGUUL1dG^J&C;*5M1e@cqa1=jVTrxTxr0R zlDGT1K-pY@jASFgc@gQerS;-HWsyj7T5gQbJrG4r5sOX)Cv2&kJG&YPxs{7--%J*8 z=h)kEh)dC)mTtuK^^opVFC!!u4U(p7T2CZ zD?+Zu=KxLJ+a>%`*oldxH$|NL97!50)xkngfM5+&LgM0l#v-Qnn-G;~CN80uW>YZa z&r{+^c`tJaWD($3cTbStF=3;n5D#?T#)m84F)f{yZ=L4!@6GzK-qYY{-c!|d$!6G< z>ss?{IcW*6r(C!!k=MMY#S-hrmvBl5IGcuAPFiW}Ug8@Lzw&-4_&Xgi|2bLs5=F`N zr`Y7qjpcX#sTsOa^YP5bMhS0rdd|iK1#p8r)5i4-#9Yj1N=CDYGoD{^fm+!~aLGo= zM-P_8ro=J3wUk{~iCi;DjS?RV(-ne*`I=^Y`ikVVES11Y8QqGR#+Fa51po9Q<4Oxj z2}rE5>+94RTSYz6yX_J{C>ja?*hZwS}BDp1>rT*k~|v?VN=~eop$3j9lHwz+BJ3MYu&1^ zZ>FWC^lrCNA7+prVQ zMH}fIS zYj8J*0nz{1Lf&;xzZJ7`pp!B%QW5#GJTS{2D2Ig=4GonHEa#hc;Z7}fLt~TQ@Mo)S z>qW5STl#7@^OhyS-J3UAGA@&0>!r{1w2^E6dc;Na66g7Y#qkm5`G6^8YN`Rj_!=n3 z_`N+u=X>_Py||vP^t0i>RIkBBh)kC;iN9KbC6O!_C`p{pz}42jZQR-ftomm2{5<=Q zbd6u5g%KFO37e2s8FT62M&RLVH;M=0ZiQ>h`R*)8<@j+cf=bKMj+SV~TI`gI z+j=|mVdvBN?Ci2u7wp4|*ccefK{RU@(y>+|B72_#a5)ndxiit~epCY{m1~7)hlgtY z=6@%o-YNE7TzRn{4}klBUsO6f%g1+weW|CqL^~`0`3V*D5uIWt(pw~^cca9@T+QH> zX=Z@(_wwAynM44)bk$eN-GlIkWd`hL{FNA?PO@a8_ky8Z^wNz{vIU~RY>6(OAS1=5 zJ@$_@WhE&MU}eo;Kbm6UzuH(U06{)8f7(oW^j2ZGb5r~BFCpe~dw=`g;ayeb!dfo6 z{8Hlg7YZO!_!H3a7N6EZ+bk-P`+#D zy7Kr3Kc;l-;4ul17vO2E2~L^M+&D4k#Zg|0zL@Ux}C28v*Ae0a#f%O$BR3(SB#XGlLn-wEYbV}prB!<>|7 zDu|QOGQqj%i3(o5RLrX~18;H`@$fI%IIKyFcMzvX&}sa0#`7pi=Lm7`S~g;LX~mm~ zsUvymImst0t$JTLiMcWM_SqV})oy?6O7)rA$0V1f5XB$!5>9HL(S7fW%D;&gUcyW- zkUpRxKQIRjf(!W7E0(Y)M-uQXjocU-kJStn^PEf5nuw*Ql)VPbb_%&GS&CTi)0n8e zVoea*FB9U7t#23B3)|^*DYzIESjqj{=UmOFL*QPWD*8W_+kY)I=yH+?;!-7g0C8iW zG7f&K>)OqL-coqIyp1jI?56lzd`ZvX!}P);@16>G;hFiZ_T;SQO9>UC>R0JGW3HYx zq8Y`8{5Vsfo~qtlD6goxXuA)}fwY1>O>T2C^6&dp#MN}!bcI%!xqvDRAAR>Ty#P`* zo?PYYGXAUh_u;UOmd0WY`cNKseq+a4f!6E}s_UC3W7`{;`o?j6Z5izgkC*F$Qnpk5 zR@d)Os$k#m&-1$W{mDayUK4vzgge21Z7S98Q^T4hbYKTf!w!1$KL0L*QmWT(HMVk2 zy02yv@&Ny22u{KmjJ5$z4~A`^R67wBvK^|(W{G6jHAfIjP zZ)-iukWTx3q0UmBLn|1NHk*99x!0>gysP)>dv87XHvv|#1RYrM2`v0qy&XYEfd~x{ z$Rg~a34Vc=pYUxC;L+|PFy}pv4YVZUamsfT^Ipu`b4fY-t;M8e*t{i*Z>Iqj*5FE(>3O3#J;*ckNv}%d8>Mh%qvsR@))NzN+Zb}Ls4m_o6jO}?l z{#aQMc9r>&mx=eb@RTHrYqokwdspm?(Cb(1?7`Dl?A>4)aGX748FUJAW&)un#bbb1Ej7J9VG~Uv)Fj$V)gf14VAy~t z!I-C}S4B*^;TZh&yz@Sj(djJ)y=&o_0y8RK3GUKUs1}tccGAhKncHaL z(I>31ei~-rTDniy6DwQcrW|CdW#A3=vVK0qwvuf&<(x>fSi4D~sby}wvEtKBLbKWw z`8MIvTx{|FyI#^E<(f6~(U=Nijq?ydAIh8E%*JRNyJ4l{`e0FGh?mv6rLD}xQtjsH z`t0$gi@V<4)%7p?eL*?CH^y~sx47rC^pQex@A!my;(Sn%Y8W$^H*hYw?F zX7r;+q8iff+i<<9jEOZXbDM1cbI)5)D2bD2wt?@Hz0)h9X&)i+)Bi{CHL(2E6DrYi9o>VW7$I~f%p}$zTjlQ-8O&K20 z`v@P-N};po?BNT7lBfk3-3WvWF{;lw0VuG)+CCCXR%ZS+vueyxfhtwN4c};pa;2j znZx6(x-^gx);v0JU&}6SJO|5n^;}cSF4bHu%PyrzdCM+2l9*W=V)qO;Bhpj3xx$-z z1T-hTdtzp6D9bXvCnrdXvl%^t1!D(|Ci!ycxN}w-CVBP(yE5Muj^&&Gym2El)U*HA z8A5|NJE=L8poY-1blZdS1ilF-+?Q?KA}gaEz46ZcjoPVi;v=(CK~8{lpIcHD(((!S zBnSF0_Ohf(;N#6k72kT|F0Kle@wekLjK4^qa!?0$fc$Jco7N(0@D-^k!dNzRi$g^0R< z;j6H#C1)`qB-Jzgn*<}jKM|+ODv;>wpTtL1lO}IyFag8}2o%h6N|Y;uCc%Ihfdwm* zQ8;TE0``F1D#gcmz7s4z^pOxJMrxkSod%hm42#Ey+%zmQ3>*TbCfOzv2nZ!M5#~bJ zA5a>oloj}Z(N1$a?em5}U(%K!xr4EmRGHWT%mmu<@MUB@eHDIqt$2XtP$4;lOqa;O z6z)W-wcsmuy>3wB38O4APs~2k*C0ltHf)XzSYZ$LpbP(AMvVFf6bCvcL{vyp|ogPn_e(xpVHDe_>WHl!I7#7L1 zV6T8o;l^jxbNNHxzTSb;vU+#rE`i5Q9;4%=qg!K_rbgcU$@e_N zFy1PyVdw+lr5<}Aqz*82KwvKn@pYFFl$A0xageEGYDJm-FRe61WHL7paU^J}#8=$S z31$RqiUA_W#4Y4N10&Z&!`N5cZ$}^&3`tTbVIv8s>yJ2-Zs$`Fr`bxC{_goH`Gf0%Mg8eSw6S$B-%f@z{PnFlRj8qidOOrAL=JwlLZqOKT;6tz zN%t28x+pupf04m2AD>0PUidX=nK$_U6do?m*Zo1 z&T_Q%1kaMlyamN@%sFJOx@Z3eXC29C!V83?i)L$A?FVAaxf*VwJe^BzGZPOC9_nI| z15Cz3p#<{P>qQ(uM&?>g+aIDtIz)_cLTJHQoa<3pCv=(gG!8Krg&NX5E&mfGgk3~J z?t%>Jl(k?_3nq1qlCaL}a!G_cUN`A0Rg!yD5L%X@Is98hB3n5uJ(S@Jk`jMdIpErl zUU}&;5|Z~BqJ21=>>sg1A;Hd+POiL=b-M*VrE^IYIAQnII=|p!V=-0Hwz5kvNt!>O zmKrO#+enlVh7ArOV}}jlhtR?G@C0h%0h^S1!QEoQ^uqv2skEeHf%K;sy$up#9Z8O| zqFWp*8dV~U#t>CavU2Ks7I+8iS#2QJcx&wq4Z>nFKKM!9v~S?DdI6$zvql+G`2<0POj&Jhn3{v< zK~!B(3R$&-{O=G!Y^X1dOX3?D_kb{3lEpxlzBw_Zvs@9hqfBNne%L`om&hOB!H6ah zM9{(2+to?~vPq^Qk#?n#UjvZhz{3S@_{9h=R|AAVLxMnIHmsf*11TG!e)8|4=|=gxWuHHOJaNT{>#;x;d5fZ0j*u~?+lDx-7}vPFgY*H9h`=Q7UixsR(l z1A0K~=f^#N_R{`DEME-q5+;jdAu0xs>Vk3{uYzqmp{x15Ls@fDX?W=PZ^ryxh;2eB z>&yV6lGEql309+rij@jZ)8SlY1y?A1!P%wx&`;3szIXI5bC~c_C5*qKO`-ET|IU=29c(Nr|SB)spav zK?0{kT@*(^$(xofbtYhKg_apA9s0+Jkbx7i-E9dF7&Km?0cO^cDg>>17Fcq5@%>>4 zaw~cQZ&RpgBygdOD#a}l+Rjid6X?OY!GF>?$WSS4Ao>EpHBuNHkPijP@2@-xR5&e1 zSLUNqV&I@jaRX+eCSc|XNHI)>6CT*}QFrr1fCafW&{x*E0?#)PGbTtWl6>}jiwIvd zot_91!hVBxgI_G`w+_??s7&Pfi+QerM&d|EM5U66&QZ$;n*G;O#YhQHm61sy4#i#6 z6_VH17?0E|G;@@w5lj*nM7P)>()nHF789z39(ajqq_-VN92Qvd?Qs_y&94qV?NouMG$WSdKq!i}o8|D$KJCZ0tx{)os zLm#6#A|%)arJPy5O{Pa$6$e}B``ucmyse=*9h(7+u7NZN!gTUvCP4U*Bq~?rhUWaO zR*iBm+U2a33^b)3?a<3t4{WZ<1ir#+t0OO2N7tWZhx15TjvSp;d3J6ctRL2_tFZM7@m(;{>P@K%|t7 zK(WP*-6+9^M4T}y$cC$-nbq%-SW@=$qM<TNzM3%o`6!0tYF(} zBy?f!vHX3_G-pm|4hdj^&<2-vLdi_@<02|#FRoeQ9I4bzy^DAhjYj|RDRy$MGe_Vt8qWvfn8_-%mom*y@NY2eVPkuaI88SDK0%~fir1vVx9|g zaID||B^SK4fx%dv4|4gT6nr#+BOdNiP=XFR0<^$vF|yt}K%zDe{K55YGS)EQ8n?$V z(UO)uv82>aRpFY%?u+5r7>Jd@#ePDz#d~U-v!UIBJwwTY*Ax2g8x7c@COp<=A+=iM0GYgU3sIeT9gX3I+|5Y}9ORak(1~ z6gXFr2pSjHM4x|Da!Dv3UPRK8J$dCsO+vx-8aL>%5tOmAR(iE5%FHG~T}G*^sMg5M7Q?sQXoZOz zBBF<;k8{c7EQ+1$<s$HUm+vcW`(pUQsC*jxKwIJx70A+aaif9^xj-O9P{^`~nLT;JGpTrxrgW-_M>PMrV+mP7wTI(mu*t4cMT zRPY!Hq&3eOU`=YMdvsbwJfuXJ``{Ppm^{wWQDMpO&Pk1dYwfV?(=NtQW8-vmDofGi zt{sF^`DrOOAaEANOe15*n}O9iZr+4$T0^Zb=0d>tX*x? zS@bC^OB20*_|tJLk)1z%U65eV8H-9N4dKA4vWIKG}3A{C2k2F>2>Y|tLj8n zXXUI@SEu(q0e0hVLBpiR%CLA%ze19!9$w?MCaqqM&^BG7*RLJ+jmY=Y7R5T4t$ey! zyRW(BaSANC8M9Q5xT35+TQ(U=Z21}5RLO{8TG(kZ{NXTFUUsq=S|vLuIukrdQ2<@F!hC;tO?VKLLL%43(OZa^qK?pk~)2lN~Eu;~#UvxW#Ct za@{22GICuI>u45cqno}npdk03x-mKbn{Vej~k1|QlCQ? z=95jL+G5qEQz&l*@?*^KLZ5O0VnQ#{!DXa|VCyT>hJ`wr)_#)-Mim}L3pwLmEvhkA zD!SnH$ci=>*ni?LZY5$3_xdP`qavnl2MW;dOeV4&VG-8RqQL;;SGBM-pPYSz>%fki@xywAAtwN-SicYO+YI${e*YdH)x3kusqJkmqV(E^+rd|m%`ZmEPa3ST> zMta;foRZQz1GW&yy{u7t@Mvp_AqpWS>9j&X)L#}D9zc?CWNH?oHNglSQ`)CnS%L8& zdv0nu+c3^*>87BK(-ky2(e z>+~gWNhp%S{v;uy5|3pr-w7xbK((}&YQe+iM3kl`$AST)?AGT{u#T!7qO?Eaz%w#M zN-|bp5KY?FnAs7jqR@vmCn*yyp){-7ZPYQ{7J2c)sUC6J<}~Bc^f5yPD-aQ2qZ+&W zg)0~ae_-LkL5tHoK*GRKFBJN2=1g;2Y@s4)|Jd}nB^L$+R^TRa8aIG3qI%t}P5@{7 z`4ZV|fT5=fHnW3NxT1MNX39dhF6D1(rC_64)uu*PC7bNt^rCz3F@+eEZ^YA3pFZ60 zjJpnl#nS7Biu^@N|17-1qOik%K}qmB!OLe=m_5PEW}Tf9Zm0nyG3$tfCEDBvR71XNsR!Yz-5lRWhl8-G~E zWqQzClaLg1NS)GXqEFaF6QgXgVF2pFRRI;?Vkl+TlV~(?wI`fn+p4*VWgutw)-G3< zZF3p8ma8XBE#Y%Es14phGW7!qP)NQ(oy0UAHZfSm37pk^3R#NV7TnApi3?HYXYB95 z=iTp4dpvEluP^o9pWqYzcDs{_J?Y%(&gK^;6#NIV^p@mYJC9@)W)eDA(IlK?mqYIE z7stRAAVDA`pi0DFk71Ry+A(%)IB^oi-3wL-;ZMFX6{szfs#NY{OBqe(0~v4XwU7`R z6hG#bSfG{4O6tPV%H#tmshu`KFtKzsQu54Cz~)snpeV%!G!T=@WI`rr+VH~M z5m*wjLP;OP!%|e^mvA&vk-=oHs$yX9WQo?oy(Cdo4~aBp((XefYFG+wTI5eK>av>4 zB~bi^gAH&2WpOp2%JQP<_jo-MaBj9QYE9Pqw6F4EG=@};^;$g zN)get4HY61p)hT3+7sdvb!1?3#ef_E%{0A@>K7lqt`-5WwF*Kn8&91Bu~WivDK5D} zN{KM_GPqt+8&$a8461f0pN;mQB(ni=i%{*jtdPuOOi8d&&JiuI3AfbXkBJmNZNo}QtEgh1gTbORdRB& zJB>X_B*b`(oD2zQGK9_Y2|brNtvhAYeaa|4v@VUO1^`kEHc6DKQazoI+#e}KGyfFw z0!i2#Q70dr*)Q#oP6{Y73iI%+t0`T+w;+}!q9u`E6++WPMe9iw-|$jugj8SMKp%*H zuBxFbv&)GlCW}jf$%~srjmGrAPyp-Eqbtd$5p;GmO3n@57I^#C=HH|t_s803-I~Q!$}?MFhP23l8FPATk~ZHhgG)(qjCIKY znpXWlzU?|72O>hsk_A6R#dyfd=2J=Mn<^l`zF)X^KmRVH^JvTsp^%D@3bbYeP{ z?pIt=nfbnGA#g~{`=MHF-gg(;S0o{mt`rMCus#t>fK*06NkrN(DyIJ=KPRe%)Fk!f z-XC8Qc%s@P3D61I#swv7aFK{ZvOoF0Sdcf`HWx5Kk2y6Bgb!?nWeEX!xhf|)nNuQ_ zj8!h0@q%=EdSUSaWcB2dQ4vnWCo$d1j7Dj9PS*Npcd$h%Blf#|sd~@JL*~itsi2I( zk@eXXyDDZ=(f-tiw40U?!oWb`p{Y|URJ>)$=uff3$Y*8BicUH(PdPeQojb8b+r4gO|U_&giV&Y1qPjanzA<} zO9)_=08W(HD+8@2iCFZp}vi+=WwUd*UVZOGLlaMwM!Ix>MUggRKxQ2#UV{Ebl*G!Ss9nXv@>^~)ZK6W z@)s4U^^MasqUVAv0dX3p^4qXU`GN^6Q|exZDJ4n`-HQ{AXJbF>G=C|FVwSLZPPq%r zZHP>LSo5Is>fdmsrUqW=_@vbs$WANG!L`a5dFVl%1`0CRu zt^z-g9NHA~p%OWO;i|QSf1q@_3 z&S+wW=%#zAF13C3q9Ug1n3WZmKBV1jXmahr3JuF}@XnB`OPYDoM zrJgP1ztw#-DSo0|dn$A2L&`ZTpT`-Bl@Ql;$?=xXyNTg0UyC4FMW_AY+hpG%Af6^{0WY?PNrf3nhC>%3~gAYLpCVe)Or z;jpp_&?;-$v0xpUCTr?dF#C@CqzrkrF$HG?Nalwx&7DlNcCOwn`{r1k4n-sL*oY32~jHd$jyWukYL~-Sw(@|b6!Hb^opAJ1~!ot=zeLx96 z9PLLchd(85;v4wn<*7|T<~5EWfG3`5p#>r7G!|EC=`5Hwq79mOp^&96HV(Tmp7xWz z@4?bGS7~3TRzEX9AEJ0u4G(hrR;8}t)uaL&vB$IY(OKq1bN=k^@hUpd~RIYC6iDPO=&Lolwyt`J<@M$Nj%A7BgPtNFMc^- z#qKbJ@Uu;jgNKvU^gS`ynL*=f?@`^BMsh5I(jT z{?xbqc$B@faCv(=E(x+58rK6i41_F_tRT>|W1}yg z+zlNw?IA@& zkiJLl2tzFKjpGI2OXaEXL%2u+(G80sgMx=f-!o6yNAm_~o_^QUAcBvM#iUKy_j7loRegoHtUSigMKK7Tt)Tw={=6o9GnylgpN`R_DuLuwHgr^O(=Y-QVq zF9>(I<(=>E!r&=U9SruNhXSK<+X?V*IN~oP$bUSR^ajFl8`sW(3}poOiwPg^kCGq_ z^5cd#4-874PG7F6;IN-d^713wbd;j+1A$x2zL&sCQQ%PPKwhN={N_kE{<-wRVrGRF z8UK)zS;f<(Gh{)Dw5Irt96i){YtpaL^R8Mr%?6mdKBk|Yvc=xzJO^Ag8>v6QqM0^3 z-KV5JhgG=YOGSzxB~2-Z<<|+rX@LbGrIkxuy$&uW*vElPnjHVMN@YAwW8$zBRGM7t zve~WO^?_{bqtOo=#wQ#J#IFm06*DfDJ}S!GE$VIQ>NMA{;`ORVYJ!MTOBIfjWxdxd zO6ySaW;IYNG-0&UrYd*I_smBzQQIogN#BX>Kl-{STKX(7Urmuw`3 z{)a8<-%AqR69S+9MrD*9Dx-+&eEQit@shyVk|&RtpEOvg6;y8(NwNG##)- zi<(WWvpV)b_=#5(*&Xi9ZeW-eJgY8lfJ;jQpKUy8mgFj7HP9dgWjekC9N$JMsX^y45*TUwW$wAUY+$EnAmwz zByYj`mEAcEm}Fv3()f+7HZ>~l<}9w+S;E5xxklMk2r-A;_}d*G*Gg|`j%l|G=r#Bm zNlKS?otj6g{ZGLjT1$5oh22(kzt%6u%&8RK67!M)HS3G@Rxbom`YzGUX&oIyJWP?O zqEsL9ZZLl!LQSF~s$6IzAXwt)9;$PrUCN0to5nrABcQ*k80< z_xv8fTaWQZwymvuPPwj@=gw#;5{Me>#0nR?IGk-KL)OQN#2UCD9$dle+#V?64xnfB zzQ1DI?XsC4SD@i<6s$g_mo;nJAGDF_8AW9&!;r5L>+%>7EoLp9(U!7+4B9vq= zfkvS-y9WiqDYRVK^pR?!Ivf&ykC&egNW!zcU@36nBX(}mgiRhcJU5#QeCsMM{W?XK z0)`Pn{Y>|*-1xQw@8;5276;orC+IAQM?9k)lgKo(y}&CMYj4pNoW}?NqNHjMXc(|c zAoFn`008N)Vk!hNX%Z$cfWuK!qEm}Vs^EnQ6e_^)8teE7x*_Xy{~DI}OjJvPgK+5% z!z2s_EB6TId-x>p*HH;HeOpD9?Kre}+xI?O-KC5X(yvYuL$P>_wBvF}Bwf6+WTef998vLvaQ!TVl3Jz|B4 zX>5Fwf#Ng-J2*m2)}q;pOJ>PmC7`hWDE>2{YsQP!K0mn?3;)+YZ|n@38MpmN*uux5 zrMFU&+J{acYZtb5bWvPa%V)dsOc%}CG?uk(#f0OnJ?pI+>+TlDRsJIb1Ncfo(SxJg zyXBfnYwG-0d4WGmCA%y;UWUS? z`=fAsOcRW6uT5-SGt)!rm?Dr%a*RJ7#mHC?f_jLKmA+Fdy?@dTNnlk3*7d67PW`Ci zh&nQC#5Izq>YWY*ymgYFrjA8y16OJ~1D$+4))v1@!>dP!LTcRqKgPZ}II`&ZccYDM z+qP|MW7|$Pwz(VI-q^M`wmGqFyxH#$uik%es!rFPTU|X}=l0xlPJbG3MIV3YE3Y7Z z$Scv}QN8>^FvgET1{!~I+<}@G)fHc~#^-siog=;FtUF3X+*q+jM$Om_q{B_ln?qs_ zu7#1){VAPJapa_f{sKSG8z5Z24(`9BG>o7^s%Lixm&)a+Xaxk?VGR~|z1pq@PMBK$ zF&)7VOnXeB(&T!cN+a72mpM)klv#U#+PrYX)dwHv2ADzT)~xV6C%Z< zHtS_UM5@)Kv-bO4NK%|<{A;|ot>ItXc0Mm*P+8(;oJpTJ<@ushIg{s!Cq9+RRHE<> z+&B+d^6%qLHea2}5tFa?RXEi0o)d_)$fk21K1S2?4RZMB6W$QCv*N3>3A6FDcgVp{ zN&=f<0In^-{tnaZ35SLFd4(^^I;dO>3j-5i_V`x6^;$x#(}l}`DJW8JLBC6@_7q2i zSriO;w>Es0s+IU~$_zlpV#rM~6ywi4ple~&X_{}d+ujFDBExvI7P($9XTBa*8$Jz< zdpi|;;5~O~B2=-mm4bEpp|;B%`RK)FBt!Nx_K2sbM3&AK2HZKnxI}xOf{=7}?c^Bv9m$6^7G4}$|c-yxcg4=M{>lZz3HbYpP&CT?+kX&QBJ_>9K zNb1IB`o@w+`KhsAH73p>tsM2BI6f^aIAg0@OhDUd>%Ziq2-^!H@f68}8bNpNuTs*~ zL|#2xxEmvxIh|wGsJH>LN@7RYv~@Wgi9>#jnxi zXf

akyh{Izybn}FK1r(6zVx=5;$fHA6*j;xKw1;@-rt&+M~OnuzR5*om0;QK2q zrA2ibqJVg+zyGG3WvSc7SNOTT-M+NR9|k{afmpXxx%IVPxkGEXEK(^w<#1p7^4iO$ zy3?QoLtny}$oX#QOWz#3hMtooa#WyKRsV)kuVV>L7@7>_Zxo|D7=_@>aEe6@GeQ*D z3O(aCUF0K+j@--PQ_9&&k>L&xT#<+xdDbyI+JUy=kj@wdi6+lReHRu5G1hw@_~e{= zt7W2jAlaTyh-ru4OaU)t5!^Fb{e`#WT7$(Q=&6aO{{8tX)hYUJTr_04h}$E8 zFHaww0@^dsJzt=e6DCOUy~J@z61PBLr3`*I(KUp}R%w7CBo=^OjZ?C_=R`*&K}gi8 z$rjy*(*o(S-Ne3a;;5Ao-n|=+Mf)PHR86{l781$SNRz z_y;CF+8mksrI`W2zisJJ^s_2|X(x^i#f&MrG+t}fl^ivTDGJs;SyD|w|0k;)UfSju z7cqZlGuWgB&V}K`iyW~2x*)>%mEjCoa(6RWaec^7CQTZvt|d|gcaF8%ZZP?J@1IO_ z&(-Q(;eSg{&#gDw&d=BC17${6`*zB`*_sG$>`O9CD{6RW>hr|w=-bBmhQo-syS}Mn zyz#Mahn7l8o~6Agcyu|Fh7;+oue6L==({eHL#dQD^F_sW?!xeg5#n1Y;{)snT!{Vd z;v5~Y1I9>pG^GQEzm3Y6IWt>NVhs_#UVNO#rH>s}<8{ zrqLj!sQC_?R!|$AKiaC2$0tj0vSuNNf(Ux5D$agYP zY0)J?Nnl~W_Wzcb>9d6E8NN>ZE5XlZ zi4P}8R7fy&X9eGR)SlV5XB`(S-nrGuhH-Q0F{?QkD^8aXEs>5%ICV!A*|zEep+4Px;i10dhuwD123_#Xzw(|mD*1<~m4G9ZI8kf8v`AP!`R21)=Zr{+q!IDCPfWy#4_SQUeOA01DCo3aYWr6F>744W}{NCi|)3C}GeQ z!l4$GF@B2DRuAUp6f*uCiIy;6b5a88?lePz zK(mA;kJlI({P$-f1;W~(uvz`=pl~Kv*$<9WqcDzt9NI@*mWjlFT?#265>Az8D#wuQ z1X5KSG%Y{#rT#wIqDjPAh{s)p*4KnzwSDS7(LE76n}55{OhY))UVS@+G#Dsm7bQh| ztuPFe!wq{|??UH#?*8oS{$|?qpf%Mbx3%%s;ILaBVkMH|%P@{hThE~PmFYT>fIPrQ zVv}!}OhmJJN1vHQ|9hf71pOWEulElZnW$|8@o_b_VNuYqap+W|2+(m@hY!P>OLxp@ z?i|AlgEf}xuSoNF4kwIb`dcMK@zKx4yB_?;HEKV8Es@daEFDOQ9ti<0D#(*l>n5i^ z4OSLc=H1>Xf|ok5gPmMprrRi{=P}zj7_~2CC1>8o z)jKRgk+0#uPjz-!HjTuiSBV^+RH%FJ`=9k{rXSVZ+~uQ(L=>OigTEs5k3xY8wn`XT zPI6;p%^~rRh<+^Y!A|PpITi%+xT_mZlAytT%z!wV7)@hqZcn;=cvj%|>_a-glK3sU zU?4o5n#oet?eTlJ&^ljwD7s3QBx$r!#Cn7KU)!Jve!n*|rB8Y9CvzZ7sXWhWT646e z)J?4h+pLYqX;~v}ybp$2-S0pB?Rs}1rwHRXIlG`H!D47@RQ1)0@vEz#AmR>q z{E6PWg1h;p#fb^Tl6g$na> z`ps*4wDsMZ#M@)yj}*&)SUf-0VIU9{Rivo@RwT*ENdW6p{h~bPwP=zG1;`QO9ib4* zg{qpGpnyJKT#!=%kT@DU9fRy2#5#s(#~7k7o)TU7 zy#9_3)8#E~`F$k|P8vobpz)I#^@ABl&3FLbj4Gku5E2~cJPGj6$<|pany@uZP)2^>oQ*f7I4(cE^Z%2(1HpS4q@=8U4HKXxa*jPyYNZ#12plXdlga z=Jz*myCK)XxF<*C5rGvH5m|`_$MBrpA%IBaU64c;6W46jFr21OiHm-4QgEFzP!-AX ze#<(pK(7xE^uG%D>DcK>aLxvTn_qkY?itVk{!J=WdNjCK0akmpKjjE_IoB6G;`Q#R z>d_G0_eLWJ-Wr*+O0(asSzP!!>r@tpbod>9TTnm z&*bMx?r}C?=8&O;bd){vUEqoh?D#iF;Nj z4xJ0j7mxVUA@R|};4r!1yXv1TUvb?zuB`g#nF_ga8kb zzECL(2oGxIcc}T-=qz#2ushCQE`G&2+@1{E9>%XG=@a1)jv68hD`B9^jz|;q(=WkT z4A0s*J$nUjlxotPdgz~#k(~0csyv3pjjjTq6so(@9_n68+O3TH%Y)<3@>_UdV?)EN zT;DneGxNDc4V0LsWxb#J8Zf5lTBy@@7Y9;%$42`0ERz9~+r;*a+=+M>B2aW!b3(^9 zAtY(Qj6X#M!;N+1c5#qf^El3{=Syp1E)I}TBvJC9cwR!87-iQpkJ0askywa*%m{K! zbx7oZJZCZC&WRXOam|&^(P@aO38Xb=&``uS3|Pv!yAfR^#^@$T2CnZT*X_9Z0sc=x zoo8$I40srVN4B6)L6M*eNMCar@ww99YHkdo7kLMJ_GK_h3{lMBZy5R0Ho2dq^U48l z)k?!eI4O{mviO689$d>9g+9cf=y^Wrc+YQlZNR#xZhp!q0>m_FPiUO*vs`~Rgsr1BQ9;98) z%3j~z0tjWkg#BZc=t-QA8o#&#F6xy-1oxshoV* zYN_B~@jRCd?qSAprYBtf%tgXUtxr|A7uy=?q8hl(>eg>l#P$wS=DyPoV z+B`S$xp=m8X|zSY@UJK>*pu56maH<(|2KGnT#XI?w}q1m z)LH%vB-xnzpR?Lo!}PXjQ=pK9t4#3h8!BLJDUDgX9xD>5X(%k|^omZx)ae$Zc2QXn zDgiu3l|*}XR#%wxFzQmy#pPYp2d1U;!Yo?O-W`{Oz^*G@rAwl2WJNz^fCNK1RCm<2 z<}^a8suQNP|4#;J=c4+u@0LV$9L8Uq8YOY$hMu|N$dBk#Dnq<<8g}+GW;F%r(+o8Q z=w}A>Ka~@!l{pc(rP{G>zBX#hf@h@~9kFvDfiy!TaeP0lwwQ_IWQr5xihoE(5Lv3? zGjs9$X!~x_uY{hdi(ZW`Y*@u(oB*XC+AkamQ&C#*mrESuy)q+=ri}>UNWEyq! zyP9!jbxZ((s2yPLXK0gO!yV7jz;^*VXM2QEN+y8-ej3+I53IsN`c1sN@DSWEmGT<| zd-47pG<@cBPe_*&jJq2R?c~#2`qLthCZ<)C=>gdfUl^q(zPaQbnj~pmgu?dEMBQ5% zY9hCL8i9m@vzUdzq)HY;{IaoRqDlzmq9vnHr;)}o;~_R+7Pa#a;9y>yUG6GduS zt8FMnc;k*;GVnU(Vgsvk zeP2!;sl?#qNYmn*k9%0*#W1%72jq_lNX4I zLMaXt3)N7Q-meb0&mIwsuSw#vRv^3jD zXaQmIjCgT>{!a6v;#}$)Y`ux68CrxTRYLumTb`J6*ei4w$w%rJoOm_TTtUh8N$1GX z*t?qvXXV9~YO49pxoClZ8=o3HG{4%csQHM*UmEIk9Kbz~1{ewrrwkMMz`iK)?+631 zsr}>fEO|NKA1m~Ks$x`gQE~YUNYNk=lfzAod3e-|hgKQ$vo4blR_zZ!8ctzH_pW%C zNhGsNicTBrd6K-xkINEpNyP*RS8lqPVCYI^!1&${Jwq)>;w*YvHq?^sGX#LXB{7%$ z{cr;+kPe9l{MAF1F$TtDG$$S3I&f{9R!^6XqHcqq9glXp2%R!GdG%p{0-9eh00&l$ zu~2JzdLI)m20I;Q^ue79T?`6zztYIpD32jAxCrwaFP1;=jw0{^e(BEnudVw#us(vD z_x+={f8NV$IrdnSd8}<;w*jY6Nut87qG;V4cMw8&qOO z-|RJDpe^mcCP5?OMP7#S#pQdQU^kOehm(DkBEt7VIqrM|xs0vxFMLg|X7@mQAvc^tU z4{f53I&4dlDoE$tCSF?~sqj~G!{=`yv@!>=%)x2dvk?Bg(nFseym67a<3oc`f7a+&xq+dQ9tWCAM%_~c`%tgn{i;=OrAo&gc8 zBbn|#?oDOScZty4We6?UH`zL_u#nJsgS3KffaCI4sU*@;?LKAz$-wj7PyHXe@bIkQ z_CN60ev)*ZDw1m84_s*(6?HtPm1>i;H|ubNu(y({8lgF&zoeh2n)$gL9C5ozQ&t_+ zsXY9&$|+fcm^m9EYdP%?kU)ACp3a>H@pOr~zVm6z-tXlUr}UeU7C~-V42Pa+r{*Dk zUEUBjY5lgOeDKtki2}B`ed#cD(6XU)lKaEkOX4wQ>AZqn@(OQynD0sN{opr0h@6Vp z9j4t?i#M&~^~rVLCtJ+=;MJ2(u6UJ`hs+Y1{_TZ%HzY3hOAv<7Uv!*l9|v=B$oL0z z{0OA$qbGD66Jh>{c&T+ji6eZyXbgoQk>>Gtj*oUx zDfWwd=(zD+mXT6skyz_Vj!QVzsU~gX!=b`dWja$lXhoI8pFsTIwO?o}+Tw@I){$$h z1q=A*st2&p7z=e54#Bzm?A!yPrbG!B3S2pX)Uq$j7#q!Vy<%&lIaI6X{{(XsGG|nQ zQhG6U&7^OO@7^3Xh`A{Ls5;+&*d06BWf6Kpc$EmG&}JgFu8k2rQpyo5p~V;S=nP@p zTcLvbg?-CnOr>Ex9b55sl$J@tCnto(z4C@rb38>8^B#H!SsUWj1@}%4LjoBXD0O0- zrXVsMJKyIA?m%?O&0(@y3})ya)ioNatNzOd@+q#^%?G!Q3a+U!|0nc75J(dj-uNQs zGW3;FFH;&=f!vf0?X&gUHd70QyVQ95cXdjI--MPocp=)Z;f?7{jon<;sQi}yi>kNe z2)grK{0CQ`@%rR@_i@A&AHPlon5^f9N*aNBv)y5ijPfG*yCVkgQyr{iO!k@x>h^`p z|I+K_=ptRww!7fe_4;XX>%N6^6LL(*&wbG}(&i(jJ#_ZeA zvd13LVI7XiG#gmZgcMluf+pasmBh~21@w3PH`KnC_8+KS1=DoBS|w#jT4#N40FoQK ze4*1tIjibcKkzkzo1{|9Jy^fBLslyd3R5!5tnl+5zWgj~91sP5@`ihk5l zP77gTt!uf)fY=SLJyRw#SG)CoFSxjR*yL86f`6d!IJl9z5Z+%)`U zi6*9M&k@y`LeCHLZt7mxyT$?zGQb=^873O4x`YFZIk=C_g>vPaNH5Xhm3(~yF{4F}Uu1+lM4A!KTcW-Q}1N$Kf zTPeebN6p9m{w`$z1AweedHF53AWMS3Tb>+L2)Sug4@ZoVmqnTw#6T9uPoME6=s$H zUAe5N86aP7>V7DhpRj7qi8<^s;){k7?fzH(1j9b#7bV=-7IerJqZx!Z~AHnkt9Vw5D^t$vI7(PaDU{*cWuxD=|VA};qz@j>mmUS@%Oma3C z=_qg<4^^DFc60Ama2n^Nwk*!XC8d4fG$?grqYa0OCas}_$%C!r%N^CE69kkwX+Y6LCO+$y@%ziMgRUL#yn7r#_Y0biv%FZ#ajBV-^ z819Dr#_Y|`1hfdhbN3th^yd<`GhIO=08pRjtiTI8=`uR2Q5p2kjDor)xhfE}n$10% zzZ>|8<3N;Yfy{y4zx{lPpzgu)GF_16NWJMk>rvxR$ux7>acj}Af? z^rhw)R|gfk6b3=K9l8*cTbk~8t^7?0*{#~vj~_$YNOy2p6p40IpEpGpTAB%(EaFCc ztg=Giz#xCM)FVNRS0!`n*RX)LdJfXAiIvNL_7=}7+Qa8vLXK^rofT8`AL!js*{x4$ zS=}hBBp%`IqfH{Nvb2D_im9iI^dr4Q=%P`oYSG*TK>zd0?L%K&cX@Kklx{>ix`Qm+=G zXg=!yGH&o$kWFC4Bi%S7hkHL+6%2ZjSc=YSy6pz7$nuaZ>2}|^;`Fl!9?YLW6IN<7 ztuKJ6!EVoAd@DoOC{ejcGZ)UE;X|k)AFehUU84D`H@ol~9=dC88CalH;AbjJeigl* zX{cfIU^&k}06yRG9{_)2ip}$10DL<4D=;D}{)>RZ`|t*H`OCSpb|>!Csh&J^5{@5jmA;C-7siq^bo#3ZtdOt*Plr`t)CA5An7li_ ztkVahU1X0OynMs{Jn48dWDbFN;GG$I{`E13<8O3jdm6#H4T|!%bV`fB*9fy_noxM^-=}z`%F|ZV1z6jvy z9caffI%O@4j0E+}(A$?V_l<8FF2pXR;U^ca8Nu+XyDK3C$G;08(`1TFB{^IC9s615 zuL6U}+OYHDchggmB6;$HK4~~X?WhHVZa9~0GdYueHC*lI(*(iv9LUkk*8$$O09D7U z2A3n2i?yh|alYk@k2^vr!yM*(fUckj9jbELq#IgIN)l>+acG>-+TJ?TWj=)Yn+=u> zVw;6%eG05CI~&_?mH&eDVwKgU?ml?*w!mWAFA#P0T!y1BgsO*j%N=FHP%ijGT32WC zmhFBMnv|)nUSMrU&jdi-hym@k;s{n16I+X2OR3D?8;?%S3H0WP8DlF~YmfQu_1TLdXDtUaMCK{p37X2GOcD(r^ zwRnO3MMK25H=CS{C!Vn+RLf~qn}-Zq#Bf!rDx?0cW0T48n{|bgP`lm%*jR3s19ORw z`HurY^gy@{TvQQ(x&YGYf_HSEl5{{5mU8QZW&bH;LYBG%a{^aO2Z8ABubdWq4F;X+ zTO$?72_3k&zi(AT5zU!23HX{niNuNOv4S?-a7=lAm9bgppldYj z_mRYkW2JF7wP`u$^itX6va|O}Y&<0edr^FCzckSg4YoBX{1#HUI9;Kj#drx~Y$@tkes^Hr_&1t7d4{>|wxb3xg*8ze#f44ph12A)D|~@8WKK5CF>o5+ z&AV>NLLa0R-1T!!14&@7Zpcr==;)zjheEAqo}fI1HmL*-IWB_t2iF@BAIInFx0lG? z9h#bahrmZ^Dr{Ln`e}HB{_>p>nK@Cg>tN-t)*B;kX2=Ou=gG1#9@xOmo)ww$Q(Aji z#Zy~L&zovj98V!Sn^N%qJ?+g4J!s`lxK?d(5cz}*(-L{P^?URXDa;>qEo7+{b`RBvNyYEN#tPLHfv`aZWq zMx{(^+kC7K-~5Zd(QcypUuftZ{g3juyMe?bW4E5d4_WPMI%32WE?y&Y*(~2JaW`6$ zqupK;v$pTNiYm=W~umQ#0unP0hH}2qgvK z4@vC=j(NZ5vDyCHO75V)ypkAXmpftvw+ws&yxhL>O9OSW8nnIS*?1qU_gy`XJRBu& zA3tRjPIk|QCv(YeL|kuBAW`NfVz&M6W?EWkM+A^)x*HcLB5+YKHueiaz2lDZiDbJO z#6!gn-NonV9KeTIH09P0&Gz^A5Bo6UmPNPt+5wE9P!e}l>YYs%fvtwQ5jeB-;3SV+ zA&1X7yQ{L>#BDxKH=X;*Dcv@h1=v-(rVJRgw?0%R^>P8NR#f;oHY z@$h|^5qNxe|h`$5yqn*)Ynp`=c~Px5#J+{GM50R&T^k7s8QB|b0_rb zJztx*2*ND@hR|GGJs_x_7ALM$iOOJhX)b>=LM|f_y=mJ#EG;e3(8Tn>)#B5*Eoe|p z)Bf$^!=xd;;)(|dRb3!mKWLybWr zCd)yy&?gN`7jsZv$@`n&{!$R3gy|W z+~JI{PWVAvH=1IWtb@ig&hDO@S3R0vNj}idwzd&f$vs9ZV?=$j>5ARCa60i%mX}`# z&*dHzMzDUBCid|bGIsA2r|lV~%aU&Wb#v14yXM-he!*7tWgjJ+H4#vrEI-v;ggqUjV@|US7T#SR9|OSdz-?(a4QSP`P|=v;jfmquK5R+eCaravxaP49K$9bReb{I z>AogwJ#Bs_F)Ntaw7x~|6vLK0crlZa+{Z3gkX>m-`<$12eO`77jpMUB+5?UH>3}iA zd*wGrvluvgxHW^OkFWGkdYuQrC=7|_^w-w%y>$=pX%_%A&_TBy`+%)jy$DwbGD z6EjhlXjTC4ufVGU=;a_TW!qm#3XroSG=*eivatS4N)k+-*=1ol0N<{D7$x&fK!=Kp z>yRz01NMQe$$G+ zucrEh8Z+WP|Eol1gI4T%-V!%xXSyV0lvHmksXITnh2;LF@>h!C=h*C!_E~-3oHGAb z<%BH*dIj07^3U31Z#1fIwg{2ueQiTe;>vx~qLJ5?37<^BnK$5V?v{nCE?b+#V}jr@ zNEt^f4wJ=RiJ>0mD6^9>+1-!Ujdmg8eiem+%xvI9JZ5@S5yT8;cosM~_ctTsZzrW_V8=~7y$*iMy}=Jt zo)O>Bfw02LeGgyt=VgCG1zbcle)}ZfB4ab$l#crf{Uk#) z=+EEJWFs&GC@&2ZCN0x$N6MCqY(FO{_Lq`9?fdJOqWtRN&@Zl4@&g!hAejGOa%vby z`5N(zXE%9FdE}cNKg&)DIDr?~(zyz#t5Ce>d`)AM@;9AYY!YCWDA{8DGIA}wk_Qa9 zn(D^I+@K#hnkAvXYNJ^~b4CZ*^HmNH{0R|eb6D!u4nx@dFOk)&?b*aC{I#M(;x8Z5qxi!)36K)$DdNJK##<=sRH@xo1%n zt4N(F53niK*23}0KwUha_nnh*Oer94>nb>vhfM;%P;hn|XRLwxIdeX4t4$_fFlJ(G z@YqEV_=<2fjdAcw+#ed90UVCq&F&0%@ZiC>bK)Pvf3dxpfW@f*aybX8b3RUS_=CNc z!{wBprFo>b5gum2DZA%H$8vT9OHJ@Ix(H(YnJ(aYyc}RYSq`-?KSo;#FvNUyK^sF@lul&EGcQaczrpbo zBt%e>b_p)s7+u}VJIr{dPVMiQ-Zy?-b1ml6%u0bAS!V(fAOxpwC)O}1P9+shH#$5INH{c^Sh?Jm%BhL=8-OT-^ zAGOD^Ht!j1f$#4Gor4Lz)y5zpmZ4C+_FM*6Tz_$ead&rF)hWRRHgrCM@WApqJPypn_Ci#p>C z3er^+_c4t#6g^^)IfMU({7T`o9CDR$t%ure)9)_-%mBabCh`5JOW#`?f$O9!>nBL$ zx%qU!@%VcDmZD*Vi8u@O9_-4P;-011PNMLw`(DGY!F=CuE*ivitfiQdYPr7`R`1VhZU zmjzB!IRP#b{+VYMZZlK_3xB0yaUrY9e179o|Jf*L${R;SD1lT@H21huK9uy67= zmtpMsVp91l_H;i>;l->j1NZCjrWeVj`g3B3wo&Xx<^J2qq_C!Hcv^%Oz=GXR{U1sB zgTU-tFWw~=*PiCWbjt6}g7Id$FL|oBJE$DlLZ*4GIXRYO+FWvJr`x40z5ADEw*T_kpY_MN z2|(-n-Ohzh!&ge{Y?|oCjoE6$I6DGErt0|NLOsSMt67X-)R%5Rk5gW509f|KuHu<6 zC0to5EPvd4Z$_aF8pKrPO=+gf_>V&z|Mr_w+hvR!*s(^Zb zlKj}H_0DUT3dal~MPP~)`KEndRX>2ilPyjZy!E4(f%uP#W3c{TIP!YqJYfgx=6Q+bVN=teDBGFocOr;cp$xm>4e%LwdlccV99ylu)&6|T zou(GCxt~AYUHwG-?Mt(dB<%P+o;}Q5h#OxB7)h;Sx3``z{zG11^IbETvkEY_E(TjT zUMkWZ`8ISX>6$|`6jwjnoI|us&Xlvt_ZV<6PoZ0t7T7);<4}i!wcBJTku6*X(`B>( zH0;$X{|Jgxvf~zQ*5r@|6L}8m3xUnMC$S6P`3WJwV1K=K-yv&D=98`3tzmho+F>}+ z>PY6QhrLA9m+zAa%WZuvS)jzP*dkQV1AZJ{?N6Cod7;?B3HEvvi=F7`TQ0iCtOV+>=GmW9BHKSGPdIk?0 zP%Z$Xztca4#iOA5-L|k!0Dr6VBpp9tBMZ(^<{Dc%a-A!lhd6~^JoDOIk`7bywMM~~GTXIRml}H49 zZhlEWt8wiu9JuB0&A9;dG$tRtcZ&e196MixW5lDrwczK^7(lS1fo`i#iqFi_+r7Gl zBiXIpppHEC&tnxzG#TT%g;8H=(=)&A-Hc0N)Z6oQh{8r^G~X2_7NUN?)#oc!xn;o~ zFN#1l)^_c%Jb6W=15?F=4s#{H6u()U+M^97hq(@{I4B`bVZ%WsUzxxOmvjnpYSNM&jkr&Ubt*tUqH{WMBIN}IMhTfs7vpp(srpvZurr~r{S zb}Dy35)YBU!HwRu>iS~VnFM766F`BXnd?10`27#iM@-w4t}@poYKO)36c>Fsx};tk zeq|H#lEJ+|w~nBM6~*=4*+ks(5)v^WKE+=W^ozGP{Nyw7iSc3`ALjRW?h=Q1NYrrK zi<%7fC&a0o?IxCp^8xL7rMHJK>o+pLIz*&h>$+OdBg7&IrCQN9H62X@<%ojd`*rR4 z+G1bN847hKNn|Wqrr4Rs+-?BA5*o5`^oj9qjJKv4qHKut0CVt1%At1C($nS(nWI#s!o~*Z5Sr^Z15v3c~23b{0XbP`7?ZUXBJ#7I8 z{U~aTXNbdOLyOfm)21kw-|PNY(VlD33qB9i`pW~KncYy`r|WL(?mmI>JzZ#rVVbKh1ruW(0t zj+qY&^lj=AlxqE9SRpbA#f3D9F~&xFYh6E@g@C58ck)`(iZ3&fPtzfQ5?A&3QPu&lC;pbD2c9Td!o` zyCj5<3=Sgm8pX~$xKBoaB0iXanc5fwsDKRWgB653nyvR-Uv})sBDlMACm$o!Wfo^& zwj}iBZ=M=K7t`?6&Q@Z2N8r`byOqRG5*A!V=E`7c2V~n0-N-Jk>e#h*=JhY>K>jaMx3;8R`ldU{%gBof1XbjKZDO z#JEFSzG{k$M8Lsakmb}JMMeX_GLDdr4v}!5UfpI4gJMhmfSJ8J)LH+&l~$*~T4m=!PDrBVTE?pnIp)J{?l`-or=0iKcT; zv}<3>*EZQH8tO}_!WHx_%IwDZ-@DpK*hLy7RJPbubpM`rO z`*bS_eA7%%i^5!>;ITyI^~1XK3PG8qs0IxE&t!7g*$ipC?nx{&4P#j#KmiG z#KTgpYGUE|TyOF3J| ziy~8mzs+Bst8{5M3sYtNdI%BvsI!bNs}Sd9X%`RTmJof4+KOq=GSg83b;_!r+YRn0 zNsYV%>PTvGt`vP#x%ONd(wT!m19f!l=GIJ@=*SFpbk&aN=x_SA8>lI-GH~5mB#8#R zPZ;6r!vVq??>{DtvQrglD@FHpGRZ-!KdK{EZ1HxTl)=O4Eh8J8N?A9k(eebidANa} zk7>m%3E{k{(c_FnW}obG-i!P1oSP>rSY4dF!yZvO`>&?KLIwnButs+5{mn!w`;Z(k z-+t8}uQ&4sX?MMFj=RGZTqPGtC349#Dw>eG6Ew3nma-=BhaC1uny z`b%}5n3>&BERMFsaZ>;OD)Ug4mZgwbAI!|~P(^k4W71h(NwX^6Ssv5%-YB97bIE@) zGd~Ql7E$EZ*GCJ14-{L=rVJ%X9bZh)b8&%I;J20GV8af zps1k00na7>9kq*--Rl*ppYJ-~Szs#3^#_tA3bD#?su=v|y-~3g6_xxo)!Q-|?IMqd zD>1tWqo36EaY6k~y!E~gQ{~y<7MdB!hc0rQz*JaQIi_9KB)RWIiJbu_d2~^F* z2e~WqxHjIjX3QwZrPjcRNY-S`%-V}ea&Bo%e;p#53)0O_XH^Ws8f^SdY0Krdy+5@I zjWr${eme{fYttGCn&F!UxQXEjPaOZz|QI!@YBNf_-aLZGbLLV$JC#n9^E2*$qJXak{vaf{_e|XhH zS00OUWPBOIC~H|B%VOCGk4m{@Jvz5D3W?FfNmP5w?+|I~tQ5UJzv7A>n7-jOi?@2s z3uU8Z%Y!+Ajmuxix@*iGctz6M*<9OQfFurCC_J48JmZ+)$ecod%)57jMUjZuGV9T0 zweBl}l2&`@)o-}T-tmKMj`xPMdszB5JY$q%FGC4lRytaHBChp)t{iUw9TJjV-gb{h zng36X7V0Hdv9BWb<`?u?G>g9wDxLXWnvIZrubOnvsxj>aid_u4yk8$JBsNZYa z>>P{;+Mv&d1AhE=8AX1@>r|Ar;uZfFC)qCPLJ#jm)6@u^XDNq4W+KTX1289dYO^u%)eQDj1F( z?lYVh8t`A+!m@9KQYwG9etKQ=!UJ}Y=Dhb;{qjEkT$DP#d6s$fqz1>^Qo-@Y0kcRj zFZ~zIyF0W!RF5!x-TSHdRtOdEXG74GqYM+*9Gc2Y$a0b$%z&=NL@wSKtD)g6F?omK zVJZb=6YaTK2IUTg=@5ZQ;$?=eOS#cHJoO>=R>*rsB!kw-3-3@`G$H!jiSz~N|JSy3ambEb`g?hn7`oS1_L&;%1 zVp@srXd%UjG@%1Z6oUO!xKVon51A_H0olW7$KgAp?HB@tJ#iy_TtK8Bf0jg5bBg!U zQj8y8xbj)z)797eJ~IxOVv)8T(r?LG{OC8)dtWQhW)4kps+r*4AR(vyb;O(|M{`I+ z)%x{J_mDZ3Je!+_k8e{h+r^3c~iPJm!-4Lq5C>J%!dj#NXXy>yX_l)ZEdd+92B0jo%~;s!m* z!c9rT|3UV|7c_r6()+;B$)FUH#4Zz~A(mM=YTi63sCn}-H@&&Fc5Ou{a4gsP1KIB# z^i6GY<)HukYi}%BLz%-Uo+(3SyTxX2;mYHAO}nqcr7@)iT*|(m*-f5O+sCYPiQCPG!tm*P_2##$e&*aRk;5Hi^Zligb-ws z0j(a@V1N!D)mEUQC;Z6e%L@EN4(4P?II;6vXS$(zZ16PO^m zLxMS|Ua%O0YSmJxOfQTqZ>Ex!{&=GIJ944H!&eLlvtcS5mPCWd{0L5qG@gW7lUz$Q z$@QRXUYd`uf*#)mNqf2WZRgfeb#qR=L;8E(Vh(_3RJk(z;z6i~J8fVY!8`J*H^&6QZ zz~b%PS%3-!LqBvRyAO@NbES{;&cql^hl8=HI&ouq@m;CFQMd=a0@;g^i6=NgqMYKG znF~jbp=Vy3lj2Q*7$T7$SaWoZqQIFI#2`cs{>)oOd>|wXNyJ7UaVI2)NnK^z?r1O^ zO50v4+Zz3eF*3T-OWo{^^-GD&jb+5gx?V~BxT|igB)=n#$H|&|2KLVD|Dd zE8MzdTb7{xHaoZsonlv~Jp$>@s>ZvKpCLo3G5{DqXl-J*@~;F)JFf4cw}HP}N-{VG zePjA|G`JbAL#i200?P~GSX+E}KN;!$F&t)>Mybyt=N`Rzh;a55k5cbU%=gCh&Buu` zF3(VBfhK`F-So~XtGDDdtHmsu@Wp8Y^Oy0ud_k71*0X~vbx*# zM!VS&f=Df^qVn>9yv!~xV+#M&*00ih>*=asi{8VgtE6dH)wJ8~t!ZhCRl3Ab+#sg2 zy*0QK({D>VZ%0Pm_70u)Avr=F2vHUE375SOg6&`TwHR8)nx}IH?ocgop(l;5UsEPhCNv>G>rShVAP$GAsE8E=={uqgbJ4e-q2(g z8MInEX9XHP`VEFhzr292`bfr(1*YKUKsUQRE)slmJnZQo3vl4$KjpEXx;^YZvLWb& zt&N4{xFXrV)@2J0nq9BLsB>p|b2PNV@S7iqr0)7=Jb{zY{##?3NVFW~l@%&*UFqWz zI5yms;;DokMHsI&$6&N6`lS+FW?x07dw=lZvZuc@rl1-WM4(%1eR|4S5~dyp%EDYylN{5s`IQv`md&owV2!+03R;F?trR$cUqK2YEBy)r^5^#}{1WilK05%hVLf??!Y<5gws{M}WKVV&dP5Rn6bznugG?zK=*)uI@pg z@g)NiE+SG4N4AFPIy&N(P)0}5b~_cqpx9iOk?GtxmzHY2sV1YV7)kgj)#s#p6hcu2 zG5N+A$|$JmSGbq5A_sJH#l5k#=#HX!YDx?%ZK^B<)U zNv1YKR4~19Oi-FL8^;5csj@`IEb)QdTSXgu{4$b#^Yn5wxSn?O&XrL_>xaOJBIHSF{V*~o6Qf@e z&BPy}aOFlt=%$mwbYzTgdXpl=BV^&h7vLQkdOYevv?KppNDK^Fy7zcG91XfR9pw}O z8gfJ;M?;QB3enswVZV}Mxfyo#VkGk9EQ~~%p_NhMxxQs9Na@3c4<#BrYjR@9bQM$c zw-s6;dl>ll4k&BKo67==qrrO&{)Xh;je1m%w z0Nd0U2k(uM?6wS}b>J}F!be?iTgKzTHdC@GlLVH+a)svx^a$ix2K3eT*aY)HnIgJT!YfeEk!`ntE?Ko(x9Pi#mc{Mrh$jXpL@0#`R!glKgM=F68D4KlX zPq`bZy4gjLZBf22L$Fo(K8&X4gpu(*f|_J5+@!;~;-WJO6D~IWePWFIdT$CB>&8X= zDp^xhaDFMP7@G6+1qDa9K*w4R$VFC&RK@Cg2Dp{VB6YFg#Qcp*3S%{3diQa`WU(YA zoWALk-H^mR%>MfUsarQ*w?kNFU=FR(8(wZ;Bdy!l2+fdlkL)%38yOwLd=Hk&27SW# zWIKU!fJGaEa)j&lm=3XUuMSDI#Pq9UpmlHwb#b~;Trx3E3p2V{1sU?gG~9_kn;|#O zHY@P*^iId<#TjRW_!3(mjlayk%5<{UCQJ8pvs@x_D{?%uTqLar$@F$J92)U$N$9R; zC<{aKR;@T!mNI6QfeX0G8GFal_zyO-W3O0@s&nVKcKm_650;aJCUXk$%ItNgfYb!v zRX3F}-6XcNS+O15{K^XN#0NZA1+C=D7aEt)yu+kYJ(TK_&@t3U`n3VcRR1u#(*mk; z2<0T^@s=Q%IUIr&FT6I+oDAWGuF@o+go{HN*cDzUk}*P2@E}jDg^*=|SOJ2LB|bkV z7&^N2r4aV{=i+M8`BpDftuhsxZ}{?a=~~_S#uuN<*OJb+e)U;e#5)iCnwwh6`^y8L z@`Av+dV&V0pVjri1x+{sU<%R;z=blvm&F&fdtP#aWbI#+og*0nPC~kHuhmRU^ddAT)}?froW2sR`dkTdX1%qAA1Yv$8I|iGX)P+HFVG;WisMDPmju6|U(QlR3#r@OSD7kuLs@7e;b(|5T($>PV+$xnVDZ#DM+`?kpLZw}z zuy&DT3E*oaVBRc&jPq+l{yg*B^HC=3+}widNY{^V7sRYIt$F|CqBMLlVi z5uq#|tui8%b)r=UL_tYtq4glE{amzS5}+rbhffRj@Y!co@nw~b%-32jt*7}K%B58_ zmE)okcD5R_O1$af$0~WI0x&A+6_hqs$!xBCvC78fFN3K}T#Pt`1cyN|w>;+$5|zWd zioaS)ZC+I=<1&llNg62E8!sKO`o(K!a~non4OrFuTG*Vf@~hfTge85878hNX=Zj z!0Q?@G^%i`I{L#DYE{R6*s81rp&xMx)`IYlw9INj45+A#YC%j$TpzU{AjFkGEeQW` z8!)>vF0TYMBb0DkWQ7XH%tgiwkP1 z^l)L}OqI1%SRzxUoJ$qMRH^I|6)%-qe2vnUO2w|MT&Yy;#g!^mdm>RZMYys`fl6GA zy;#1kq!Q<40ZzVLq%zD_G+4e0q!L-tXmiCKm0nsAX}Ow>N^FI+DdHDrO6e|$D4Z!p zS`TJ-&VBN*E#d>rWE3LDa>rq((%*Ur_r9l3MB#b4tsB=&P2ba9rsmF>ygSWzSf{wUl+y*gnoh#PVoC!_SV2r_K?zHRDeWg=O)#bPL>2#1noW{Q7fRbHSI|OfI*F=R zC@m;a4KihHr?}df(g+dN5mO$(s49jj4G={|Fr@(^D*2_fLqx^Blop7fjF-|95mf9_ zS|Xz2TuNg^REA4wk4S6zC@m97!5*beQe2luX`z%TxFa@K$`#TPwB_U?UnED+h7%2G zB{RW3#Lc>(UYVc~H}k@xWP)bg{7dVO37T?3peidSXw8X(vSOH^IVTRPT3~|KoG>WL zdASUE8)Q2bDrp3rn0p#dTQ(fSlN{^;QJ%oP3C? zzX)1!QlcpFBJglH84=cR5i}E6LS<~n3r;5J8Y}{6Ztj_aD*|v%;fRW>2wHJduZ&$? za8q9@fOWx%L5V2Vg}{?6aDXp3F(`~@z2dE36#A=RhC03%MuFwXQZKlvFF5gk#hbv6 zXTP`Hl`Qj>n{s`wD!cLOx#Thp6k0hK2EA4uQ0j!Yt3UpD_%#YvDBrHrYikF#6~P?2 z=m10~Rk^<;VVE|Fe3|wygsS*=TCIS4{IEpnlO!&XK1fO>q!03CMJ6RAIghjWXKbN z&}TC^`6glSTL&d9YW>DW|8^8ARa~uNWowP%Jn^GPFU*rZWI#m`u;f``O`hc08U=as zZxxLN`=StF{R%x&pbhHv$f1hM_oNTm`4dID(ua9aL70nvUb1oz`=&(gp6uy5m3suQ z%grB)MgdlG4q1FExT5+#^z#ks`^cf5ZndBF_jbB%$^AXeB}q4iG)W}e@q9PiH`4pl z+!JgX@=$LcYPH{R$w=wgWvNIBC!RnRBKV!dF1+iWK9qpxY<%jmtOxdpH+@*D^w9cZ zEJ*u5y#vM$jY)j^!JCu%@ z`1ETjQIBOU1@|E0N6HrbqDmjiT8Z4+j zE4kW9g(7-s7jAW|$4V0S(%(2=iP;rdruf7ZP;UrCBQsaFvx zdI3qQN5zk5s9cU4en3Oy+`IT0GYH8-FK|bS3UB@Y?7i=D8#%Hs`29xQcVK95 zgzR3))?Z8R8Fw6-EZICwk!q5%r%%hlD3c|brzuiHQr)ed+Z+33zwIOJe%VL6PqG1^ z3Y7_DCQy_$NA|R1qDKTW6Da&iWCDpF-uUiF2zU!5bCu#en13SbmX}!pdJE^U;9Kh) z7ihLfh5C6sC3}O{O+i!zyi~ap4nU+z@j5sTm}2Ih7fdinPk3jZ-1(<4n}|#gn2Dk> z=u7U|1FTtzqx6{f>|vwFx)_&1Hk2V^6>y3zR6=>iS%Sor5-})Csdym_3OLCnFrHkC+NrHE6>(w? z=Yta+gd}IZbLAk+B6rzyi7|>0yInzSIf&3bEENLe5oB?#9|X@4WYRqs0J;(6u>doI z>@d$`SeRYx7&u-z%ojL(IkZ7)G;^qfXmDF1r%*K3Z4{g9`Jth2sT@&wCai-!ST63d zkb|C0QU!1jWyA>xcvqDm2XRiMh>%NI0d^3k3+xOs4oDW58SpTWEPXeR>g8k!LRio( zlyM*ML6SfaNL|M;Nx?DjCjjA}0EFx`4{m`+V-Na!()U3g6bU~E6ro61=?esn6C|$m zB^3(th%0>&tNsF{mA)pr5QntVmqeivR$#02g=-Zqu;td#&0?;$3b)f=(>vtTU}uK* zVjTCy@mpMn#r0HpsKzzj+U4imnS2;`w#3rHNzR$C@7`LtKai4R`hgUK+XtLyfX&Bm zdU|efiK7RCj~T2yz~|xNq3CZP^N!1Q+LyqtgUy2Q>0le)x!!PrGv|f?pe^GZA`YcB z$5Z#Wf7S-0tq~TR96;co_{aF^ULP{}XM!6W6p`bYIXln>tL#y`x{jCVBBX*|wj_=t znRhbhCl|&t<6w%L+f|&%Y93>>dsx*Mtm6220S;v^*p8%{#FYO%oK??QpvUDhNXvfP`VW|N z0tp`xCb3P7K_o7dgNVd7F@#54q={g}Iw2m0*w2kXBL>N+pMoY0i$k2JMPU%5jA#&I zCodX^*vTXKJjB>CIRc9qBu79IgJc%d7;Roe;SUq}G7hm> z*ef6q6WNg4^*o9+^c69;wFvsqtuP+9#gDb*09)J*t~l^vnj#8@7-dA_5Ib2s6mfM| zqTq{kC2|m4Yf@Rb+v>MXBjT|w*ep04$Ps1X9=L^#MK-B-6AmQ+kXJvArc_|9ek!US z0$p`JBQ3YG9R$^?KrrFU#4aW?K7h$_#Y!uh1w+MrIR+J(SO8PuOblEK&xI^FDM~B= zNKs-AGK$jNlMo0NimTvKdhlvQj&44u%_#6rh6Dk0Iy4>#C-iS2(563FP$~_v>13BM znob6U$}9&B35QvFj~wKsNMX<+MG}1W!@*NZ1Wq9w%w*|QQ&5s{ON4}r1m}+s;}Px$ zh&YZiVS&{sQ$ak&usr8fEr_d#H5LF+1g#?X;i>KwkyO321J^T)3F%kk4V;Ve&r6G3)#o-;kafSnc*zB!~zbjE--yu zC_I}*9O##jcIA>^z}7vgot+;-*cCr8;1zL?DY!W?4=SMKFXBaoJV|^_!6qWASf?TQ zl!EJ#ux}~2u7mK9g71%z?|Je>l-H+QO7(z;pVOJ`~*)``7sKSkd-E`?P2Qm->it^;1&=k z0vTq+K4(GYdoEH4Q;mGm!X|oDguZa|;@`BODP(@G0vut5=PvwQ&rB7pd?Gvi_65#~ zc>Ti3ihlsZ%k;eN(7|c&1q?TjW%MI#m|YS6JQe3KOny1!4vG8{hM$X=>5y+f(pz{9 zqf8CIg<%u(BUk?<)krAAPV@n6As9xZTuo+DUVe1T02}(km*(_FnlDZ-5dwQ_?AL>QlZ2MxlZM2V_Dzh$ zoZ1&Ey<0*HW;uM};!7s9be_c*58pPSrCADMkbr$@re6yRhPm9S7Wi`_syCe%QMhh| zWWE^mMhY#WBq7+zS5p`{KCLeh9LvyB3IeV!`mGgDRqYG=`Rz=lhJ}3o^7Up2gGT9)hscTRsEsEb?8DD1ny27nnz@lDsO9 z{v-(2%NJ{@Bq4>*6cVH9#M&R}g`-ytE=8x&I8vV6FS`PV6`2q#x;`PGV`Oh7I+ zNO^}nC^9Dvi{rYSC6>Fa^lZc3l+#8CjICrzEeb`Reo$yh9VIlju8sM@y2d8kV=Hb0kW4z$W8sY9BF|$8^{Gqa_anSM zO!udyK+Nt{WsesT_~nYPKF}56Sv>KT)>5CrA2dEdf0V?MgAoZq`*|^zivCat<a zQKXVhD85DzQ9D*U&~Fs*5;3V`xI^4{!brE-G#hW-0|Jj#GBaR4!zdNXm=G@ZJjrVb zI991(K;p3jbb6Av$j6Krs@`V=`Cf?*v+UVoa@VZ|!1r{E>s+q}0H%UuEAlBu3ysfl z8Umu7eXM+@!5ukPFHbyw$2)4TiLmSofm@8C>iw+x81mX!5z#(+U6h!id3M>PEV~WVBGf<(V^f^wqNkm#x~eo4>?;XRIk zd%^e;VaGx65<)HkYyYzc2W76$#O=D-OrpmkOn=eXhoH$EdrmsMw|iEjhDXFlcsyAwqJN=kU<%3|INYM8Sa3%sc@^got<}pSR~R zoODnSAZLUbc7p$`j2px1G-OO_b%)#{zo`+^-{Y+4#5@`AAFjy5?Su@vq_ zhImy8pA#bIsszmm@p2GYmgKbr-iKhMS-Rko#AAohvm~=6@K^yBEnVl7VJyIDNiLn~ zv5;uBB)?DT3B&NUq!d8n4;@|)f^4dz)RoUWsJZk&DoI#&1EVXlpF6Gr!qw%*&gn_rWAcD@L;3uQcoOb<`sER(~<<2n=OpYnApzxU;csZIM68Rz|GaV85tWq#GBJf!; zC>_lWXaoUb1rU`WBnPew2vJmm5V7+Sl`q5vx1)t1Dq{3$xI1R>rP!5YuQHg zgF+Q@BBpObm4HOVm?rRwn4#=aO2P_s!jLFU$4yoSuTYx06iZ0Fi(nWdAMtPnP?(02 zaF3o?m^_q2W@*B7!dfGWK~%mF7Ce!bMw4@55uBnVuq5O}IRJ~2Fi1))=^W%Dvnr9~ zzE}x_k(SJI#0j^sh4Io2OPqLicUkk#U+BhA7d2R$)1!gv)KhG5Df6z(-mx zNlmB~9s-ilFAM{*%(=*p%tD9AD18;gdgN4?%ote|K!2=IPQevfh=T`Np&-av;fv%! zDYI4lrZtK}ti((}D3Z+hFKLKbDnUvz^OR*Fb^~~jNoHq&VUR_~TW}(mTnGn087_$A z6jxSZ4+2pkAq+aDCx)V%mqTGz^zGqb_y<&mf}&;yNKfWB@Y>F zPSmEac--Jo2$Nbkc(C~q8^OX6gp(hr3%?yrLUVFm?UMT9_zWiMDK3T$ji#H$TmcOjS>VN~TsnMR3MRQ9jDaNW7eIi>JP|@ag3t2g$z05AFss)GTx9EG`P2VRRDB^ZG7w+B3jqOfGQX z8H)U>iIfYf&4GQ1*#duQ5CjN-3;kE=7{RIx~xQ39bSXil}CsWbjZ>p$@RL_l5%58@{3jRRAREyh2QqXEk~#6(6vRUwbg}0)K=h@Axihv61e{7CO4aHBFUO&@X8%ba<9<2 z6>~-fWivbX*pPJgI+{%7jR^jJm`vpfg4efzk7ujxxXRQv3%VBt((HXFNLOBC0;%?X z668+3Bps~`e*4#iKqk2T1M7~u5MJ2HT@&|!lg2nhRnC zTY$zdjSDG*G-P-f>MthF3yoD2x`n$`j=c)f7V%R-LKy!PCDm(+a0C)+xH7H?wK*Fe zgq8#*&WEEBCwDN`h8ga5IiVtA+(pSYHw!w{6?*B<7}~fex0q-ak@(V&)GiN>@*AY;Qf;w8d{e-P(L!R<)mvZWoi)ovr8QR?fYt4-OXFn_IPMx?DY3-b^Q} zC%>eNiE{ClPd0CKzByCb-F*6NXcAiE-L1{%D(2zo2cnYW>?WIym)#jX3O0UjJVnYIz=`D-iP zpHH=Y$dDBs<<@+-%=ubl)yh7vJDIh#R0jtH>u$#cQ>jdOtX_?DYK6)yZ*NpANqlW; zjrrncZpLV+X1VZxySBr7G{0t;R+DTI^V!qM>}N&yX|=jpe*64+UdA(A2J!VFy$gQ= zB@J6`<0c*boL*($3&W5)+eD>sG<9|GJTJvIK3&5dggqhf zq}A&WhV}Eo+oUsSHR@VRozxqHZciuy>TOqIskQ|H_*McTrI)npgQPi(=o0_71}X2X z+fxGbfgfl>@{UJ@*mp^nkG zea$OCe&)ig1C3syhch=cnhakvX(uEfZ3alsIhX3E5mZnORzvwWWVlkA!BU!HDLEFX zH{-f(X5#vnatQV}y?RGA=%5=Vq_E3qF~%~BtBnSv1nQAx0uuCHYP?NO>(RABH`^Im@%2L2?Y&i^KB&L0_v2g4x#rEv zBkcrFGbv5Il+}?T`TBLxf8qLXE=e*gCOb0FZOVr*7|_+shp-jE?uq;5{PY61K}mP^ z^fc)Vc-8{y+-2;(?<9<24v=Ta4&ogW_aZ7ML7KHd6naU99xI*xpx$ZlgT{T)hHQo* z_gRbv;rs|ki~Q+H$eQGo(IltcX6vN&@G9uxT@d1CG*`@Nu$a?uG4`4@(Ku@Vtkq7q z{U-lLw%`PC9fNLfSJrag9dFi1YSahycK1z;DEk^5Ey-9naZR$8mquMSU&~9QuBLN> zhTSuMhtt27Ud7#Wg*^CzN#CFstIX@=IXtPi+WqlD|;{hDgYHkMsRdH$?#3Ddwy1>s`xQ` z;_!aZt9Sb9Fgsc#K!+hj)*FM?yJYzK$3emv4q@0Ls!dfu(x6v=m$WO&Mldhbl9;Qc ziegD*Br;@RP;YgV>Qk$w?!;;ZmG8nZTQwDjE%o*|h*b%1)f6OzF&V&eVhauXw*^Us zLLF!*w(yg1;U`rJM@UobnP9k`3z90O1{&I|k#eb(8XDtZvD<$U`+t=_7Q#fHDO zAc-t?y(0t>&WqB@?1nsN7sr^w|I*g4Xuh@U(q>D&txZ>kwJEVSo9&90Hm%YbLvf8g zo%>sZpT+dMr=9nijJo?gAgo^G@8%*gQVB$ycvF&WAd~HL*?&@UHtG42f#LDcgXAEE%JJ}lxDNdmJl{J3z9$ym_z#`r%iI4cjKSpvBna?Y?;CTHH-+ci*%+6(fuPcGl`8{b8LuC^_c}?l!(pnx@i% z1#s5pVxiS{zwh>%L-Pp<85iyMoWV8a7BtQx15e(^$E+Zj)Q7sk@ZgshEPyN7iEmnx zapi!$QUkx$KWo>249Kw1u1aP*5the=kgp4&;C5Vzs_oFh}gmMv{E@irRy6;cg_3x9RQVl{S9Q<8Uo1WCq z+k@fzdM|m~J?~4S(}C<2q^UvDKdU#w(wO@`g&_If55NQ_^{u($*cmp@g?m2$LRb`X zE-5^NILr*R(-X#r@S%x0&14oeQ8g7LoNjWEj#&fNtbeivThK6NS?J`4xSvAcFtgus z9{!Ybu^-Q^uSoh}N4;8Qe z#i5~iz#)LgOanyA_We4V45An@?a1nL460A=NcR;S%>kYJ5y`4bS>zbGcQHtKNzQBc42A5nsst}O)xx)(h@z@Nm3 zp|Zte1>~6+v(fK8EWn+@4Ev3Gr^7j4fp-X~t(BzLNIHZ1o1~CDJn3~$hmCsUt<+HP zxdOJX?|ZGmAYrzd*jEoi;)a9nu$T1D+mgN`o=afm_L6%3)j_fFnFacgtv@{Lb(`l6 zv5VlV44fEqJQ5U>KjOeiIX`Ri5d-d%51bG&Ld$y~f~`tNUHA~i!1pBB?h4n2exiXI z{k`tHmeSd3gFj$8xvx6VE691$9QKm4daD;F555G!OYFW&dfaW9@cR*zB2vfd=FDsO zI^UlS$Yx)jpggqm!RzjMr>SrEnlt>9M8^%DOZ~>bTM=JIFL}cr1G!*;dMsx|mX5!xKh%O=2NZvCNw*ps$NWt$X-g8CjfmZ-Q$v^%4!gGM}~D zZGHVyZEM!s!~US#V=wB2Ub2ZPrk9*{2T61}-cvYy8449lDV^cqZ8Gd6gZJGYvrkLC zqeE{vpS9Ws2`r#!eBe*sjg)S7;isV1fba93jbdepSF-r0ZKyMfmb%#Vw?WeD)Z0UK zv92F#uSiT$;{1|B4D~#H0&w&m;-2!)^^l=B?L@hiB1m1-`#$vcc;3?I9kUvmeUDb> zUDx2&iGxdeB&b4Zdb%kascKp9ouLZl^^!)?dZ#RvHOjQl6;=Jf(1H+t@@Sn;46fDe z8%cDyQ4X1yhlM3gt%4H%Fim`7i3&SuG?I26ab_wXvGj@0GldGNw8#eEcM6ques-4R zwMcJ39^qNo?Ds1@&RtKA$bp)KXR)?4D9E_~XG z+uI53U8qN^=mVa&0WMzoD&`2y>ph-D8(;O)L(DUz{skWhcYF8%77#sx8aFu(EHAu@V|}_T-#?kc(5Go{>z!sh!kZRO z)buuJV5~=+t(mCR$W7_sDI1m++~E~AxwWL2o$lbd9h4M@d8bd#-|a=FRSby66K!SxJxNLhGXSsGhJoS;QC)e3>m0sV}Ua9v`ep3fP!==^| z%ON-u(lsI2%~1Bs+QVgm-G85UAJZDUq;*5m9()L+N&8%f5?85Wea06bqOrPt=A#es zSkgZC@dp;f+b4eMbS?1yeBxbqAYfOIVA%a2@?Xure?hdA&%zT7Wq&Cnr0x@ zf#Ig0^a%|jA&!T1FC=_K`nSR8-*N&qt7vEv^jp%px_lUo;^B=++)bA|j|h^qH3`ct zscZ&B<7p7HS`v{+A}|)UH2!$h zX=xBj7}L^76!4@aBSHj^mW&7yCt5Nf0+7(8^}u02hh|Jc^abeQ-Jl-c`yhcYOE$8L zwH&RdT@2-D6%Arsq`{8Skfq@b!H=c!3^rh-(Mv!ZOJml9FP3av_cEAd;%dQ572wca zT&1(g?`Bs{uPXD~8`kEPpp0WC#TRLyoUT1}l+{nqo%L-P8Vy)tKPA~A%CEGXkdVHi z$pztiL(_`_>`pEiKP(M%L>lAORx{G7SY*-W zS0!7kf?>t)0XuV&-A!?3TFAO`rVa$E3>rfalrn7k00hdgedFRyhV2^B@rJ$-gpm}z zQW7{)^h|>Ykz!PW0RAXOD9HGZbaaBiDog_9dI_BDN4jdw1_%>$5hl ziD<$wpIhV%;UcN7r~y)D!7fxRZxlFSOmKCrCEkh)6qHO*r;iJ^-twClJfOrrsm<51 zAnWB@?hrxt+7VvH{sP0Z*0H`4&M$7^x(`MXdQ=-qBxde5ey&IPzR7T21{tHO(a=C% zCK&M6^I!_IlV7d*VYx{4$kqw4e1+SFSWxpy7~%6p)aNS3@X8eFK;%?f^2QG4uh0zY zh9&)FEx&V#S`DbEpbuW8%u=G(D7DlPxbsYOg{b%^DvcYS$<8MwR#9hY;fg77G!Pte zE!35`JPR#Hfc{2`V}N>7W@_=b=U8aGa=8`$IwD<(q(B=iMU|sKiIUGG7ANORAwCwJ z8aSycgLBYziN}J6qD-x3-%>&TC$~kgKd@D7>|6pJdP9KjpaQPQvCvIJVdaaokv>kn zJBKMi%M`kz>4{ETihYy5Z%bMY5(F&JpL%DP6j7S&J}1(goxMq3SW>J(&mu@=LUszQ zyk}m|4ByYfB4(NM$)Ix*pGwo3(0hZ@7z0x%VS=lL#5qvg;9(o2g$iU|G>r%CUZcC} z+OC15E|>XujOtjSlu&=%)$uoY1ucX(X_}gFM|LB!Fn+rDlM1s@mLhh@SgNYNy5 z{cs>wDlDm^s0u^lR9U)$OHYzz!p`Y-OtdOe5EoUB5=B#%EngChc_E0TU{Lfuau^J? zhVq9soGAyl7;3@e8GuoEDq5fsfq@n(L~(T)vM?%28ZwBCifBkS%(MW6j5Ht$8WQw@ za)|`9CDSYjg~hmlLX6ZUDiZ?o4o87RU{0xMk5yVh9kV;23twkV~Q^tse3G46d~#_U?e>=(i= ziW?ISzchLKj&Y5$sdEjKi_u$P=L~V+nv0|?{Wey$rHQ+{r{~>k{Tht6jJZ_{dq8gV zQp#D8<&!8pew9-neXCLH^sI*UM@@y=*JdF)*MvJ~h8*=1xQ#GyiXp1c8ZrfK-X=%d zNLf7^FGwhPgCfxpC)zBt`~<$CB4@;=l3(t~u|qG`zI{j^@Vq1!PAU|L*_tQ;S`nH) zT*RA2v3&1L>+=yAZRW|Tg2(eUt8EI5M%B$)CD3dVB_9`4oSbO!GJ<9T#_%EaA`Q^p zO9u#R14AMh0NG2kkp0HXqms!dPHy;9;?iYZG%tDWIOz1p;lf1;(p4r~6SO5_GWJM_ zK^iaiM4U>w5PIWl_=fYs&kIP4dQ$PV4ew4k?}{OBfDML6q1NbrZPw+y__U-H%L-!v zoOemI>~IZ8K5cd=78jED0-=#SZYIg^xVA;Yb(kLno795&3|pfX<%d@yItz;)TC|O& zmPDGDnp-xdWT|q{Bl?c@H87{V6Ul=VQuh!uo-SaU%?>o%wibTph@5sK_xaF~$4@(= zJQLlKB@E@LawHrSZf%gr9Xm$RsQlvJQR1xlApsaLE_#BMoT2vZMP*+?6hO&e?kR`! zsiU@=`=5J|H`5rG0fe4}uuUDD%*6ht zlRBa@AdSX-5I91WS|4%@SY>+aJ_s7(6#9BPiRT;53^m~tm{o}l!gqqtJAj?mF`3{# zm(S+GgO_dWw{gQfFJq*LurnVi0mRI6m?j!qmZV~*v5*rKXpN*d7Z6(#h-LYEjF>jk z%QS^}QLbl(TK-)52RqR`Sfhm~8zU=RlzM5H(8A=hreyOOOm-?t#hjR0EEArn2<8FH zco>UlHHdses5I3amrQ)RG6{q!H9BL65HMv2*l3cq5>E?zDT(~_zK=s;aQtDldo5mw z)**v81GD%~2sv#8JtT5xc!_WTZxCJWWANUuAlc4;AcCAhycmY!@%YD{aIj5L_@HC7 z;jbX!jNu%TF=hy^Nbq(thiHFBJ7bKU`2^S==u=2x=0aTSA*V+8Fr4O_q$+_B3ZuDz zfv+o34vA(X(U6^>Y5NfdT>^82Mu8_lSV0LO5=*X+m3p%2grHzMLs_ms`6W@HKq}6$ zD5$w0zQBk+Py^y~jtA&(EG~rn72f#AgGu)P1(2XY)A|PHI|dD>^cD*X5jd7G8UqXh znip3^G5^M^za>(!4Z_%@^g7fGg12sQcWO-o)c4)qti8g0a4x3j^`j4Zx%{He>)Uf- z5CQF_I$a;xJV}TLv#FZeTob?UAGdX2pCOf;w0X3UuiwqYuAA6jAJO4|FihdI(pbGk(F;+XpGqBeB)gYC{x}@eG{cj1 zbng0tsx|XF+6}SlEl3SdfU&yZVCsW!rK>4NRNj7<3S?>{%I54;44M%IAnw$*U%)8B%nx8abpM zddk~+=Cw*s(@q2dkqpfq6Cu|^lua%N-4gj5uDcxy&n7=$Wip-<5oE~>IA3O^l%9yz z7gT8gC1`G7FUc-UEZv25{s=Vy{j?+pR6w$TUq2N=4B^rv!zx;InF*;8Ibu2iOK6ic zLQGT9K12Itn8jj#Ok!9+;639+p8G1G5d%z`*eNq!M<|R0H4P~O2yYIybck!JF4WLJ z0GjyC7k^<2j*OYWh>og(=WqKv+Q`d+Vr0(#I0!205ED$^T5jub63>`2Dx9SDN*c{4p;ifPDBU=zho-J=n$rB&>7^F-Oh?iulq*fMUi`KJh-2 z%ymL=HySk@cd=y9oFA8mbYwquNN@&SjunhFid|&9L&Dw%vN7-AClK`HJ)^oCIopg;XB$AT!#jNxJ9D!2D62)pq(qc}GU-E0O%b4!{a6MbXdM!19zG_)wnc!B<_8 z2$XL=k?-)qv#|Wc1}MaP3V@c7Mc_j4-h+e_Fz&rTBugjs_Nhp(9>J1@n%e1OS^n-Q z2x2dS!ieGUseDd3%VU^D38$bED&*UZM8;9}Kd=)h>{S%zDhHg>fr5w29BFte2ad;j zX#tl?^i%^a{nl3pnjrXvY>t>%w4)Yq>gSCN-tWT8PX=bq$ok|6PH7$UjP6nCs;`4I zUdi9vA3xkXv}dB`^Cz%0!Y_GXrs{?%I8W!+6C$(lO$44!Niq5R1y}(c?RbQsUNnW! zWzRx5=;Qi#q;O$(-GN1A&zm61*7+-BY_1=SaDJ>82FSnaPbSd_x1KQ)(ZNT9I4G1c zzzVJsi>Z(A0T}67dKu+bH+yd0UImSSI5A4&;&2O}Y|mE~x+C5e$X`*Sq3E@LbmcyC zVlYOP2@2Y4qH%xbG41p}vM|^}r{~lHNULwQLi5fuDuPlJOu~12`+p(V8E|RcA{u&R z>oEo`-Q+a(GKR7{lyELU<}_PPB0j}aYkmvzq^$1f~_-3uGnv5vN85M zJj*M_fi_)>VXLCF`W*=%!3H#QO!ii ze5^!A5G*YbvP=qMC}Qxkn7t!;KXOVgY-k_z=@oCEIM3p<7~j6w8<~)<@-AHBE@Lr3 z7tW~bGZB(H+w}5xf0Lq_O-2X~rJix-!CGj5DUAmJ;x8}ySb9$avlaQ?@h&R)klltiT%AT3Qo+Suo(jW@tm5jW zD3%;II=^`5lc(e(6qY*DRxrMV2t!{{6f(MkzDPRolmf00GI1O6I|Zk31a!?e zfS4?7!ITCge$+dILIR^mstH#@i@sC&(-2Rdm5o~UXOPOP9 z7omy}-g^bMB(EWg7hXaff7B$q#n2ZZTSoFKMB3q}E-KE?fCci))l%W|9%c(-YfzI# z3KNZ-lrD@zp*w9tQV0d9jEX~HI2$2SNg-LGA|l%n>W@W6)Cv+o+AkK18A&81!~4B6 z3I&Nb;Pz~2QItvG917#OVD$TsAa4N(SIAX*kmQbHpy{5yEb=ecExh^wqeUycz0oLE ziR^>^S}oOCe2rvK-7d3)*kr>6DEv0Bj0nEQ`j$a(J5@XpYz+D* zuowXbeKR?q+&mQ)Vn&`xRC4wXk03K=pC&Jz3X3T-gEAlj3EBSe{)sm%2>}M=Fq#RJ z5udz#-R55SLsb}+|W0954v7KEPA%yn)DYdNk01$ z37t%|hn6?%gV6xg1Gl`}1PW=dc8{}{K|N@+oJ_E&J`%?E0>v0<>R`_}QXS2{v+$vA zO8zfmeFTuH#O~Doccf@G8BEu!KsldX3 zVM1Xj_A~-Xa_A{LLl?0p=P`D{_Rg)fUwjqbvIO&Xk_Ltl!j@d)JIEw@7zX7dz;W?r zmeiqP^Mk)D!+!ZBz$CR9w54|opNp{6;aYs`C|*J_^o3RP*s*q4?hSrO-vciscFG-m zHCom1=chvv8OjIAoJAf?cazN7hYC6r$_&Bm*+Nh}0J>hJX*IYLM>~LM>rqM?6^EK9 zM3moyHwOqx$5_Zn&W?hRS8-Dj3s#(h2;2Y5y%UxGK6xfP;Mko76nvJWb{KK zBV7~$MI$rTmX;&-5tLU;5p9MFz#5ODim*T?4x(1hb@wa?9d^{1!2Gj`64+*UIE=QC?d%6 z7HUM4`U`VCLF)twyQD5iGcFq@37a$u7p6I3sRUs=!)2xO!(;pPJtz?8UDS$oJ`J1AkS-evo z{+`jQxs<&4L~*>m6*O#B)^vgZLKD3uH-oD6QpCGEwhM%9m+76sqY%a%qROi%1d%r& z$~Q7nU$EfPlunxuObXl0l_C>fCo@3y9LyYF{0RbultC$cB5|XYn~nD{A@hTL80e?I z>v+wCg4V?2lpGdm5Tc0^jIh$Zxb=>F9p$T~7X=FWMP5%R{b=-N=;kPW)YNPjRKy?R zgt^L}&Hz~uEXA9OhlO(}dN;5w7?x?ukTW7yz#1)I=&8ReChrZ=9z6k$z$=nqz@FeF z)bgvIky&St5k3eAINoTl5zI6^zFIJolr&Bbl$x6k`~$*yTW3a4&!*TmHzLTLm>6*c zt!N3~f{b&l5WfQ(V_57j zf?rSp7Y#K|yDzjQ+T#dhi-I{8Jm<_4Me4|{NCAt~k%O0iP(gGUa`Sp*%aRMVwT*5S zTGxCRa?(qwATCUObNG4z--6R9@vHK~$}?aR7-_F!0q~8aRd3_7$uEhS8lFmH713_3 zxJhswC`S-zBZ+Jzp*>4es?8t7;cQ z5j>jM!w_X9QAO|FflhgxrtVnS5%Y%z#6Eox&K#JoE|i4C1Axj7>TZha?2XA}#NnH! zoPV>K+kSMyhTqwG(%jk^AF%)2TBuA#T1gGB-EOmv>-DW&no^NCJ zj{rAuR$n5iq8oW&7cr@VSLo&qR2!Xl#I>_$2Akkz*COGG4NkVFLoQ!5 z&_yii;@S#v>DZ!;M)xw(qhTOGi13$AIJM&ZnDgWk-`7om7^j2H_nC4KYaiS1 ziv$>YxKJMM9GPgZs#t^pa*TuW+Yh|y%W|Vp#hA~hYJc*dWA9I8w=e1Z^L`DdZ0L-vjVh~7M1CD+n!azWUzGP^Z zau<9*mV_v8aF$3GN=VIc2y(yf+_nqC=K>cs!u`Ey;nN9Qn`Bql1cMo_&i7{@;Laa6 z?G>&8zkTbawKY)Ek6Ewd*47r0qHd8^>|G^8wdxb}s~o_wY*~}YIh$HEB1#A%xFFvB z#;r#+{ZjOCTkvv^IMrDoo|r54=O-vk=an*R=E96y<3LFd!}pCCQ@efx#;*Fx&ZVL( zX~DQR+n_er)&A~D!^-wo$6K>DzlKcilVa+e{cm!6zdjP^O`cz*&{6zLe~+9g5od#BYDTQI`ZL z+n}+()vk52dY^mBy(E@%%8@q{8}n#7^`~oT2_9{c_jJpdU8J>T6_D}o(=)Mh`R6(H z&zq-xWzqHYPznUoRshB3qfmKh0B}}tYikh9ifZ0PiM4hBW^_lT_ zqsE#%$Jaw4qAE$!Ia1{^QIGESeV2PELfgpb1WKZ8WRX0QyxqP3d3c+r5w$!eu*#C^wr`t}AqUr^2;ojnS-=+yi{M_rpm67gkj|WSt=jEZp zqqNjII?%6UVhzFuHa^}B3mJ7RWP zy?uJM$1Q_PHNN*TIY+xbDmpXPZ?#sP)uw&hCPiu-e(LY1Cj2?G{x$R(>odv;x~5ed z(kW4Y+8rTqab8YPUb#U_U z?8vw`9rUDionGw}U?8desp)ho^g0_BrToV(u+|yyTN4!mqJdib7x%HwSeqI4FSR^J z7ncWPiSKt(#^Ssh^`!Nb$&ay-QI;$-QePYkyn&CYgy`)9-GHoy@1O}TKga&V?zLZg z#h3WKTeOulKBJJI#7Wjir{B>aOvEQ-Ynv9zTpAW%HKHDlQFFySA%BvsY50}BuHHUPy5EXB47l#~ zSJmO;_?F_WJd7PzPwmOy_xDFe2_3L5ucQvjHECQV)A8kg90axqEh<%|ylu%_{`s?C z=9jAq>m*e_o~@2XAPskg8$Ecj#_pb8c|fhct&KPX1@Mp!Av|j^wh|H}sd#b`1mWB~ zPDxZlh5ys$q|%JKy>GVe%tJ;N0rVFX&!PC*zZC)1w$wmj*)riE!8EHyf%l~IxgN-q zxyG*4y41E+g%4DYrJ7gx>#ns|+tBddbex70azcQ?0ItE?7Njt#h{dJKbFc!L%0 z8!d`+{-q9{@8}7uBIK=(OdSN~?Xv0Eoy)ZLSOJUgOM#O^JnH+|S%s^5bOk^tH^7%g z+YS&L8arbOc;oD>{Lakr>UTLC7zuOa5{BF8zcas0v#Pp{^4d4{=>{bp4BAj+J7zg< zTv=7V!mBgvrOMf3v^uO&#S_)HUkzEMkGHSRKyw~?WYde8hH}!rcIs`H*Ekk&1BA;r zO{Gu?J`c~E?=(Rlo2lv-Ww~V5s2>k4Z31|obswv_77oL%+&Gl{F9~e*Y^DnW&L7$) z9xq+}o!GN<<;Blv0EbqMi@3l#9Pgsr=NZ%H9QN0UdBr(R$A((2(5A3y{CYVD2fQfu}gQhr{88Ji~^b;3@Vqj zwEZ=rCa@H&s*Yfa<^d7yExIEfcq>sq5A}yz?dUEcp@sWNypkwl8KWrXcg==R&Aib2Z zsp5=iCdoVGqOs4pPtD)`UtFcizoQ{M+`x(7g6{eN4&0t%e#x*O?@*i8{82w|)BdG0 z@Uv-O%`zw7Ynz;ytD~c1gHPet=J#%%ogKjK9=as+-jcW=9Wj)|zr^%bq&w-e(lX7U z*-L-ygzvh=I>seMZ^k+5+hF;GzOcSrPTt7G={^y7-;A#&_OYVrAU45 zX@RBIVP=!U=Ff}DpzykC)P7}ZhUOk=iiPa~M-m>j15X_xjlB7nFLnH#uHjjGrEhmI zoTBMjuUncKQ@nE5ADMP&D_rZJ{1T62L#D#pnmYfgqd%p^y`DLl`T1AlRw)m%+vO(SO)B}$tIjX?pw8## zqq@bf`iijN@Xjg2@{b^2I~|{C&YQ5{XjS42Wv@YD^5s5telHH{ z8tL*J#HwcCa>DppzCs6@?Uz(DF}GO_9KmZh+iR?PdA^^|xclqXV%)C-+-Yb|Hv9PJ z`~kCUX5zL5@dv8$y)5dCkN8;=7nM)UUD;Kns^E?sYUyCyed*V`UyrXd?wCz|J3h~S zUvuAeD@*ucP*(nO)_EA~N3@GQOQTJ%*KW7Ib3Y3st!_u*Y1*7^6W^Q=|FQ;Mo?aXy zNAHx1758b~+|spT4TRU&33pGG?{vf&S6lF(KaBplGyXYpsWQIiM?9ZZW`30@R#vayA^#klr_{|A>Xq^5zb|z#cs?E-kd1{S2LyCj5 z;~sG_qFPq5#`?|1UNuH2;E%bW^9Nu~mjmy+u)Y)#*(K&0xkiI3r*IhLL?o!Yo$!A+wjQJhLL?MSRy-WQ{vxo$FR zTFBvc=>J(2B)2O|njCF^_03w{%ZRn98qt&>YD`g7DXbT2W>73^Th``~x;HqGB2sC?-sLG7W)JTQG0uU zgg*K{T14dsLoKrF9Hw}r@|jj=dd5JmU-oWogjA*XtN+Sh(VsjJUP7h6HAiZ0!H14g z94yzI=qV1+q+6vHD+vu#-`pL&mGqdT^K?-UtLCFvYLiTu!pMm0jdcA&nr~Mvoe|pouP7eOlyB_D~`O_=q|1kA)*u~TB+UP8B zZxY_1;I{I8)Bjq!r=5?4;+?9_U)f=@x1K&X@)yT^uikOneoD`*2UPcHi65BX&|&bf z1x{X@LAIxF;PtiFGw$=4=81wn?d7;<>}KZuf>VQ;)3Rfj^I9Oxp5L&q<4=p!6nXFK z9<$Fq@%xNgw464>?M!&wewIP~uI|W6@e#`I$KRhK@=sCrzlst+#kh6*T4T#ar$~E# zKe*kG#GjLd{nts-;szZg&=*29A#Q-8xw(TM?gP5u0qx?VCBd{Y=zm-4G;-K0iM%ZwIE*HX+}6(l#00 zW5qWm(!9q`r!EY;-*0ac)Lsu3JnXLx|5-D(2EdcJDyLQWJ4--DA zR9JqWmajAV_Sp;)&PyFh>vX}-TJtX2pJ@VNEOO==Z7(oWx!$j-9?W8TYAzrbYVmU| zFoi^RVksisCvs=U$!gdZ%9;pDMW--QIC36QBQ+Q8ilc9`!IkB&^J`Xb_uWK(v46C` zHg{%sqAqhV@6dPm#I)IQMr8r)14kt9?=^q2ml2K)pKTwuIgb&YYB^xb&1 zVvqaE*Bo6-zAzi5tk|6`dw}hR=GEBKq1Np?8_L!zIq<$X^x-I*PEAtbr(n7(Pk9jk z2;_kv{yU< z9-1(H+BE6V=3l=+JnI>7nCF%YqYc$;cxCgqLhiSI(VgfjX2nAAll2Mze7NA`KBdcnc0g&8^~kT!9t=3hSDcr^HuM^V?pNI$U*nDR<&_> zcQ;{TnUDJO-LQ`HfS#)2y!O9a{~@>Q1COb6(ro^KXogvZ=(pwM5ByWWW_Po$(-p*G zqD<6UFeo*pt2N=L)-IFsR}|pGtMm@+s55L%@>MMxjq&!u~RLw*OwVH^Mf4?isrH8_Vso$l(%~6t5 zoVMp2jfB zvVj3+;Sg&x?JmY>xe6)ejI}`CBb$+Cg`Iu_zbZ4^$w$sa_!3Al%;K!VFMQEeyqabn z=$XjV=>8^Ev}vh+N-&r0D5h;KJ}>r=D173VQgRJ}@|H*RmZ=f&!R%p%&lHh3L;OEM z0Vig5bS&&`oviW#>_IS<16EWz(yUo##?&*0)N&1IrsztnwVP%XwKbVv3LFH}(EkfG z;78a}z)|P_(7BpreG^vMnNO3YOYpcV@ccH7M}sfkS%xy}HZ`-eH|@NM(^+@8d;(b} zo|l7TX9TQ6291#-iV3dEpgp417injqk=x5GTl@9j=zwB8vqBuH54OiQ`D^&Zlrzp9 zin7NOZEPvo7N;M60L@Myk@ZS7;#uAK=L<$~owVegB+tN->>EN?bu8S(YF+Rb?5aOt zxS6`96{$U;pq*gZP!XKByavckVTe z!QAL8MP;x@xM*8GuTcw_@&Y}2sI`Lo!zmOua zuLm*{Ij2dB#3j2X*F`T6^oJXU2>K%z{#;%8Vq^K>k?gRj28R{VgYwTNb)NmFtm^13 z=y~>|Y@piT)$uLO*~iNm%A|TFORwnGWb9|bUS01L;>iuRno^^kk=BVV-E0!$Z~8bG zCb4C|goduL`-V>a)Y;wV(C_wODQYY8C#Ptd-nP)KK@6iz!?X$Xzr7c+)=Vk7d8us5 z=b=Tozba>@w6m1vF1`GjY~0TidMmBUT|XJ7x=QOxURIy$q_13kX~>B+f*vv=lmd+5 zo%~8+Lcux^z}wk7@Cj`O+&XnnbCJ5g+!XnmLs=tSY!LrM_9PGd>T1Y~^}aX2g{g~T zqu)iu-FBX>p6zf260ptaCCmkQUmOQnu8laMbCI(^5-6FADH?jSOmV;AhyG9Q0ML}J zk9118jbo|4X`u!oRqt)Sr|P87Bmx&v*Cs-Ak1p2sKqyi})ct68 z?#=(hA;1zD?w>ibaK6J4V)mJl5%(h+wv{>*&vT?qA1W>#-@I_0o7LPwP2fC*OVnS) z%U#yF^!p6KcJ{5k>!`)F-nE~cHh#ptke9FhJ5q={1H`GvvEcocPM*eKH$n1p-4x{f zH$)BJ3+!T&W=d~rZckJi0_ZN7M&n8U3!S)`IcJXL6N(#kVBwN%h_mPFRV$^kH8og_ zTc`53?c4t)6PW0UF__g|t8>3iqHEd1X$mIA? zt(EIr*y zGQ`Y}xYr{kH7cInDQQ2eIO)L!tm-FuV}`v+##FLuy?;&;e{4fm{%0n+o(eH9Bh3bI z_g>^fIEk{-U&10ZJIY`~oGoBHws{=| zGqiEB-s#KFQ8GgJhfNs=Zxtx(IGkh#eav49u(4CG`pykZb^g3n&+kJ^NpCmZtQO21 zo?VQ&9T@JYk33iZzfcG`1&6BhusG%k)U}h$w0}+q?3s99j=+5Z;jeCdh9I1f{lQ+# z{q~P@8;^vbEDyJN9v77NReR+REK`HRdvxE1-eLkEN>Ys+dSLP zl$USM6N(iOKcak7FCM)f1*>( z#eH_&wcTQgF@Ijo!!j{@lGd^)KsDZ>lUlF#?mX)_RCG3g{XEZR0E10dYr>v0NvyTH zj^MA~AEoA^yru>_W@e&e-Vf@3#zOW>rga9ZhVrCd_Cl@>bq0jFIem6*I3Hg@iRx5j z+n5<1T2uzpBb_=prFYiDRlymSwbi9jUHxe6ZEELys5IkIN39*2NxG}1pZ|?nu!!-g zLuytQE`~! zrKWa&Z!JYImAEWV+@^dUkS_L;3B-Ew<_~Cf zD3t_dSsUB8q+L^?&lP`BXyeXSG_;c)ABFgsjG5=34RkHmQRO$mtC;?xID@w$7Y@=- z245J~3(m6~gnvGk%;xLH#R2ejjk+rn#(vw95_#kQ8-BqSrSklJ#H3}?%tmkbSvy#0 zF%pe6{dt|(RXrig7t5epQpDgBVeC?O`;)eZUOR)> zwrySm@Y4F!Pq552`j#Z_;2F>G8*dMWm*+yDE=GM zfL-jmY}6TKl0B!d&=NNh%3Af?)%lp+C+B(&!o=NPgYaKlQv(aA%dfNy80_v6?n-Zd zk8Qqdw#Q3-=P>`ollFmovk?-nb#z~cvE&7roq9-58{(}2PL(hR0z0^FEf<*e^#fA+K^{{wO`KQ%77j)juh(dyxxUll7{;iFab{?*8JxdXQPH*3PBlEJ(6 zUy(~@c<(Lky;jxs%BldM)vSl_0w{ zUD}BG-jqs}sl+8LxNV|732w*TdsoJ6>Eq3e1u%fNWvTW2Pz~UaGz1nq0QJAKD|Ts` zg6e|wF`(YlzwyoWH5TsxHZ9h@eX^Ey=A*s!g4l7TMg%aMWt*Gg^|>xKAo;70EvO zZb=jQ8CnP-_0?NNKA{F%KQ88zAMYDx^omtBte!d);ju6y!pdZ7gOh(4Wik}=675%0=|NMs%F_<`OZ^zPLEFu8?EJdAgp&Z-SgY+TOw<{Lqj&o$|qBHOnQe*r&odUXV<0-X}5J_rT}F_ zx!1af{OT0Lo98_6(&DM@^bXax|DL0Ngw|jLufTKej|2glDyB+YlUJQzX1QVIw`As! zU=44e54vv$GP-!Uh}CG)>gd8meC|mig_1N^cS?cYJ`E3ck4;Pa0jM<~)znav8aO7I zUx4$!fD*byg0H zY!wdZR%gS@_?;dPxpit6&$BkFHZE=Mvbce87+O*_5e72iYoQ11!Ws=$2pC{5zTTVP z(^uBWYj6{v_C&DcHvVxZw@ag+v-Z9q#Q-i@34J5R5}!Ka1nP-)_-|#(tOK9_pqLI8mjQ;ttC?+yM%^?^*lAHF3VeL|+}$0n9@t@Ds}U#w*%Qf0m$ zIeh-vw`bQe)fnwGDVw-rWsS6pb&gk7)(E|G< z#WDQc1CptPV}jn)#-Z-SQ3y^4Bu0p$1U8hH+>RB=%LFS9rl*P*22j#tBa?VEn}|km zEhGXX2ZT`6Kq9>VV*3qK$S8<-4e@xh0}1V;)tI1HePqFRX-p+iWr1`+0`C?bMh9;X zj(_nJYnKnR%ssXEC2^4pkP$mO!4sM^o#s@i^N-l8Anoq7U6$*<%nB;)~Jjsa>HH&Y+Y(B7gFdAz&864NMg zKN8b4F=Z)EXa#;|5Q-LoD~rs~j{I^QWd9EWRh+8~Pa#~Xt;e_Ik`M5vgal!bX4Bmj zvUn=FHuAzBb@VMt2cq9UNQr0!+H159$@)749l3{w{WUOE}T8js` zg^W@|)Obpv6(Xscv~{5p8?hF-ay}L8dem)uV&QaBfGj41@|GE_Z*>$1H4Ln84dfM- zmt{evXL?Lwv*C8gXB3~K3#1#`(=f4~K{UUdA2kZ@{VN+A;Q6U?JS#T%?x_mED4unJ zuUhpxd3wm|5stQ|2NPh0O?+Ffji2Q5f7rW=pt#yVZPyJn(73z1y9PqA#@*fBf;++8 z-QC@TTW}BV7MvhK0s#`pY4ZKM>OWOydS-jlYtRh3imFxc_ImD%qjynPAuPtC#jUFg ztCUQu#!=#IW5;+;q-1)GZNwB~U}(ZnW`Y5~8YEjvkbgffP=pK)Cm z2bswqZ7nP1;$t+|qS#6rmpi$##T3d_^Lm=3P(>zg9Egg zG}u|GN|BSOR6J>(Z=O8R#OpK5c1SeuyC6~NhJ=rst{axS1fXv%rJp>p$0d*YxX}F; z#g?#s|EBOTbiEMF9%>gnEJhQ*5Sx$3rR3BE%>?_Qj^qy5 z^dcrIgFmLkS))JvVWQb(?uq&UQS3%W6DOvZPDkrQSH88O3AxaGhfClcxFvdU0!x7j z4qb`68GlW1e){&yCAfQXtO;v|fvic9y9k{(&zdty+id}vgYm2inS)LjRnkbvBJiL% zWY}7SzsbDrTYfaZ8J3agppGs?xj7!(f#4B0Vuv-I4d5rTIF|0PJL;+*>J4tRU8vP)mqK07=}ktxRtrA(QoMe~s7%$+7N z_}n3zp(;CaCYCJYkrE?JtE&Lq$g~zn8Za$}lAw%?!o^0wq1{lTrp>e#g1Tm#w>M2> z1#eEkw4y7}A@+*37SbbgIy=(E^3oDgV8>^A0jMa#qu?R~L9~SA*oPU`5z2dp#js)n zUQy|wpfws@N^JfN>sV!W{bHd()2GOE1jxbZ2DOPk>AYAJV5?{*jh~z(c$ENhXoLFY z02u{$B33&h*O2ad5=2{ZBBRV1JaZO+>lth84i^Mul5`Rr5(Ohut>t|qHwnVnnl(l@ z?t^3>xTVnzf$dzZKsVOGW2c|+5fWf00W(HS+eq}*UqRs*F7(vK79@5tU-_Gma^`JBVXed8Cm6*el3SBTX{6#KlA-LCz+euLQNQNK2QmIVYnpKorT_J;qi@dVMe+;qG7OiAdrU~nm|NiVtkheW0Wtqo7bSpWnQj#WA;@DT5%qaIH>dN@J zAe!@PL%3E-r2- zl{VXWp9;Rl#Z_&=J7c0NoS}HjB+RnAqLw?f;Jo}GmOY7kJThYlGLKK`fKQ@}BEBkZ zjv~f8TEVs9Owd!$n!LG*?~*~eQF--Anx&%GD0qZ5I<)5lNjTZUX9!$0We*7b)*E9g z(!da`Lv2Qzqz@@+;#Z0eoVfd3U-lt6RmNMNT-6Dh<5a~Pv-H+<%MH5pdaL_A$|oS# z{MP$%@rZ+i+~9na2PpzO5h(<7&g3PZ$!|NOj!~87Da^9Tc3UpCFow)SQIc2{mRo|N{E zYsN&@r#q){LegV}Haafn&@&!bh$cvL@k!gs)7(NFKO6%Nw!R+k`HnM73^{lj*R@|e}TUEK2-A4fd33({5( z&l=7(aX>7A8oA}I2;dE1Y>G8CLDmtVO#KHij%K9)4C7{HHKIg*xT0x@c%+SD4oUIZ zw}pIrYbrAnru!p(JXiyjb<1x8oL=AJbaU;1r2~2B3l3o|L-YA_v2x~lo^41!b+S)N zPh_z>74?DX91%lvWH#6s&qzV#&`FmS;xCS?GD6p}KIsW-!gldZ#-b^Og1OpB?0WCyw6c6T`JPi@6IMg^7>fF~F&- zaX52(s1$76>(dl8iK+S|pP!jKTdP1ibhdJQ15Z8d6EbM4mxjjI^eP~M^=&`ep}mP4V0%ZSAUgqvgK4sx%HAUvDCN13UWtCoOA*|KS%=8<^QKBv7g1 zHEbhs(Ttw~A#{>&jS5k7tp3k^XOycQp-NB#FIPu^j8Ebesr{_f$`fL> z6xbkhP3Zfgn848R%D}!oX~xrO-lRHIMGFKDs|*`=`mYH5!H5EPE#`M&Y7=7F^r};| z+(uN9m3h@9hkS@`QJJauSLl3(>%IzMUg?`kF8RHHv19Crq=z(N%sV=%T!L zntcm

ybA19v1gJarVxVvC-KoVap+fvdklaYN;?2RHF7masWpVFwzxPO!}rv?UX9 z+oEB`lv1l|nV;#uq<^^cBE+84htP{^Y+dpS(QCy3rT72!DYhsgofe8mO=rF#jAgcS z3_?Y0ULl9`R-bWXXn`am;uxTBASY3vZ4TI|9>XB_w>$+6Bu@bfG+D8|a5@;#p<;D5 zZfCAOjAx1ltbWv?PTI$fn{&>|h+3mU+U!!m=+=Y4iw^(6i{}t{(ck&mFiG+9yR~b| zsJRnQD@-V9Sqlq+0+UG4LVFb;dAO;20@-HhJ;qI&3r%?{;eZE$=l#CK(26fNa; zL_m`J)UByP!|Pb2WbjU$vLUx9mzu}Ci!s`0Ux1=(>{|z3G}|{p)bNbGPGI#*11a%R zXRgeqJ5rWdf<)$Pc@vsw3eQ8bm}$L9D$g$&g9UvI;rf}u*%yrCn37&nrAAHSOM+i0PaYlY%mFQ^0yDE=27I|njS`~mmCeTF+TvwH{ zFf(Lnp0tX^zR`r3i#_(JK{d!K@)ZcdnH}kcA{7YD&=ODxZ(#~8QfZ#3NyCBD>iw3{7DOy z&~7=R2%jwQj4X~Ar4|yA8sTb`s}XsabKX<(kZl2dwMnNEr7Q7ZsWcfw#}hLNx8s`9 zb#i+`eNqUT1!Y!KoJaY1! z+{-c1QvA}Fl7)~*KHlXX$$)K1MI4WT@ITyQFx;=IRyvA9cS?4)W_;;kiOdfFW|2IJ zDwDXMR!fc4%@P20bR%_%+DLQjz;LiUQx!ufT4hyrwlppjI*dC8P7-tRDEbmjDt9x0 z>LFr*o~P0oE{-u3EW7Ik(G~|Yaj&COi{u$tOmGB>=ol*&X={QZcUps}5iF(uk`#3S zgvB|`+0(GFs3KxUIjnN76+$)S;(amoYp_nXe0`LJQ*`=3wlbCk0GGuiQC)k1XI#QU z19PHN8!1#Jy%vHkqP<~@Na_4H->*7mC_1DB+)DPj8IVldRLp-^ve6kRdYjjEx;anDU9qy9ni|t0{u>mvXD;@rIMRSj9qa=im>*5p zK#zD#_zkUBJG13${qcE>cMv=h*OQ#gh@C3`NU&_sNVxGa4>NbE%Rg&TnElOKyo>Yc zC?JSt$zIsl8Sd$ZPvqY`tL+jGM8xt`n*!s!R!*Nh5|M|L&rfYxK&-{o{UFBwtVNc8 z*5a}|9Jlf~G@D}D!nbo(_9%aLxMXA_02JjE81w@A5HrCbTA=OIZi@`7sPdHsVl5WF zS&JkPYZ3O%TC`0lph+kC)zO9yg?_v=;7^}6^z+Nb_tfYXH^(iNA4OXupV7*hL{E*A z<7wc-!}*i=JBY@|EeXnyI_O;_i&D(<$H*uvdZG2p524`=i|8A&wL1$p2-h;Q9IjX4 zg2Vyl*iJg(&EnFUHaRwX}vuVvog=|GgOEY5aT4T=axqyf;G8lq@XT5>I6WK{=ZKzZ}L2PsVR zp%yBLIluq;enW>4;Y=iFnxZ)GV(v^G-DU9c&ogh9BJk>p@bjRSuDh7qt{NRy5w_c{ z%Y#o{_=QSbb&u|qG6n!DkI>-d*Z5ZRje~E-YzCx8VG}vWL;oGqVJVZNA&QTI#pk+H zt0^ay@Lh5q(^myqb;rNF3_`M?D~D>JD;i-MLzPJR5AYGKHK#Rm*m-lMNAm_^hMu#j zw+#**Zo7(##2$)TrYP>fvo1Ylu$GVtm$eoz2j82sc+{N=2kYqjEuG3nz|A44)x(1V z<1i>0OWUyDMw1Ja`S4rx*FY(ZKSTu_S;afa{wBKhz` z&vT7fR6ohX2yIRG9gUv+c8S*n!-X+E=x703#Fg0e_lv6$85U74W8NMqECiXnyi& z`@PzJx7^c~qPzRIf92}*Z10J6!aO6NvrDEsFJAK9+4IA8w+^qQE?(B%=k{Hn`ykS* zHba(l-;Rem_#Y4F$u284=fdY`0ITH*iTv$81IPN^vgKYw{o&dESGkx!FE4==m&~l5 zeRh|Bdc1lwg#5eO1LihfE?wNceqPo{Wi+snl78@c{C;}AEz7Jc7)5KjCKi03FkJQw7pSv{mb@&S#eX_QgJb5v_`!-vz-lD%j zThck+w{MkIT&4kRw7Nf4FSC`v`FR)9J~h(N?%D#bP-kXf^7H$%cSvNiwiFPs%4KA$ zgZNdhjs*$+hrNeui+10{2j!RWJRJ^{Tut^(5yIE9wF864{`Y=Cg_}7RP0Q&MShSV% zjkYa}af~wuJ*YV&$BaKF3s-d`>Rdlb*TDD)1qd5i0Czuo?98y?wf`9Y{#QtKOkba^ zWoB}kJfE$Fgx&phXPWhu)0gYVaWCiZ7Y`mID;U#v{aq=41#10C>l+$eX#6_r`!rs& zWz9P^tz3R=zw2}@R?g61VMMRlvezj+G?U?4q)ra>4<`Gz+qK@J%I3PsM7GA4Hq*Sb zc{%M^UoVUu(yZ*Ile+Ud)hw14JI5uMgU0vdB%r5XTfe&6z~>3acXXSlGjcwX)1Gs` zJ#9A0*RkU1$eD5C(xe1s$5lYBHcKzG9 z{cg*}d*|t0J9qPk>d7<1s|lQ@h~XOhZmM%MAHDjj5w0~SG)~xUL zZp~!(S9?Qph+DPwj>k1Klt$D+%@A}U;AGprX~{k|5284g@MFDrv~=nOc>emBOt?bf8nLTCU!Q%R9JQw|^k>o?KQ@^PcDjNiI}io> zT!$-he>4vWn>5u~`7aA6AMaF^3oYOTg)ofe{c06RZyVC68!c2{H>O5)yt7EuYJG(4 zTwLz8Fm@#*>i(V|o*w25l{kWF;PhmOlY+>JkTPVKU4vI^o*LTkjwJe63lb6vMhTxX z?lGpMvf%~$adS-X38}R1S8eqKnb=&1&HHQaKQYcT?RkpyduF~&s5rnoIdj{- zMtGW_CsF)8L2&eQC&BSomrmBU>maZpuk_CxZW$_B$TV?V7kIR7*6uKbVq^0E-N<}FKj z>({W4&nrU=qv6O3IB6Er@W)Y0mc*x+8~7v+Qd5e3(;**Y{mHE*V9wMAzOL2i;hSau z&OVe>izBWaq;W)DAmQ2L8^Hhf(z30`9_1t7okp|nOtV4O%)JE$YIDY=(WTnPh>OnR zN^Iq!a6=11N>*8C&w^OpI~AovU(>oDEk-)#W|r?RUYhSJ1WS1W*53hK!uqHM!lIEF z!$2;SSMD+=Lsu>4xr)BquV{-O$1sTof7956_zOE&QEepx=EJoGQ6fUVwF;e<<_8iw zOQ$=h$4gFNsmTL&l6|M_;W!PvbYg}RviH7P*LRKbvUtU&B>|8&&_xcTi6tBoy zIfDZnN&0adD^Cy3Mmq0Uu>_=8*ol`rloo(k}$1oGiLv)$0R ztSZNiXYjkE4OM~LWUNJ?XQO{(liNgj9r%qQZnD{pxl?+-yw;3pzh(mC-hRmPwymac zqdI(FE4x)y;3ES`ODbkh+DwP2QdY+w+_ZsL^UR+ua3pBOq3Rx4%;k;K`?e`mk+z?` z{{*|U<=Fi+O>uDH_}&n36_@%>T`<-~sVw_aGrRX{TFr6GM$PO{F)m4fC-vM{SEWi% zozMW=snZ+>?+$Ud~6JInVF?niw7!y4(7X25hj z&2l`=M!OY*M@Y9ReEy*7&>v+~#Fq=GGn;e&J*pdTFsT(+>cOe#6GF#PJb3r1xpeSt zIa1fdjX+||#HKKaIR{jLKY2!_8^f^Pzfz$n`1B=}0&SYH=6MTFHZeV7EI@JdpmF+f zN*q_>GLL$V! zr9nB+5(R)ALGh(t9CnN1<5)Kf2ug_ie$I7S{40M*<(%kYZ|V(rd#ynQ3|_o_Y8A?~ zw&Z~(R$2R+Qqm}B;OnzepjR~@1EO2_kp4G|hKxK~md+2}4=g%o6?hgmkS)qyo> zqB?eXi41>o!uX?VBIjZ3jQvtxDdnSMYA&PM$5M^HrF+XuDUzJ^T7SLm2?huo7G7JZB@xY|whkJ2* zHs{aG<*Q-@Xe6Qi7#k`TouNua+j%(0GW-eHc;=aDH#BugwX0aP zv$mOHG~mE)Ut4_gvb#>n^e3}9`9xWAb-==ZY23KS7Y`2u$e*nJ(WBbfb9vbXsH2NH zZCe~Wn|po*4ACK-_MFmLZMQKL2418*74&(%Z}mkl{v9QGXU?q{vHhBIhE~;#lrRU# zaWr2Z2!d{~I-~FtUH6)X7M;oguEZ`}gGT5Vch1~0^UH@?cW1N9g-#V_pLeG5=8#7S z@mvsTdKn+I{h3zmShnk{;=>-f@LRuWKu`!PS8^Sf{sy{kGv>PlR0X zaw{gXg(G+)vkLLs1sb@oyG!m2ZwHew8vT~dgmd}_UzTYDXY$M%WzGIF&(r3{QZtV< zD@Yz(P`Cc2&eNpQ#Y4D`fYnh-Q3;J@(V_v_G5<2NY$Z6N1ei~_{Xokvct|E&uqh{u zl|>&gSINnzP1*5!eos)Y1fP<`BY-g4Ou<4#U2<1?DW`VzTRr#!qE8O%EVYl|jJ>vU zaa_FsrmfV*hgH2`!L6Kgvx+!m!Dcdc*;U$0^2_Q;)?HB|YBg~7O|R>?_7WwjIF0qf zV=vfH{CY3xQGXe*TF8Tk>fElKQsuwWCHQW)_4OATd)jHR;kmY41xZ%@!M*uTXxYIb z5wlr6(Fnp>8nNBfua;r$;n_Hxj3&3}w&T7Cn;)gHK6IX6L+Ag}Fb+j;-(O7r^!yS{ z*53Q{%WSA7z}cGKUZ0B{o01n!Ewn)rT{RRDdjmvKZP#@yWwiXK(k{FB_2JWS@x&!2 zFs{Kbkv|HNo!9|YoR}nwD`cL-OIR_ikq)+P(c%;~__(R{uqoJqn*hwAx}mas@`wX; zmhwscLcey;wW6*XG%Y)eT&M8hhH=i$o|RviLS@7Xp*E{=4rWJ`;j%= zZ=5$f9}PZFX7hsbF*cmGoS)QrB(>qAwJPliiI8bv-+U1Q2UY7@45_Wg^LiMX8nPb% ze979+dz(YJa7u=n@6MH%=Ws1pj`b;A+)$L(#!5i`YswY7BB@`Ocm}^$I_l?5&essK zWXj3-&tis-lzCO-K$UigEa$inLBxb<1v zM?l&r>uYzfq5lil=8C+};=C8TI@@U-@=#*bc<<7!_3R>k-v%IuJ`>G>?M zX%3n0mTU&_(mS0`f3fKOzEs%i*JZ)0y4buoq>M62RDRj|o4G~3jh?HAZTTlmFYK3q z65AXlw^iGF6{dGvm7(&?LxT&7^}(ty>@$8?auABLebJD>SyTOk=^5AV;w_?0>v$KM zi+7pA?AOKHHgipVHl84gr*6Y|4!e)~fu1usXt3ITla-79|RWVt@-W@ zQtCS^kaj5-A3SnYk^D%6b02PG&k;SR9vVS zrwa_Re%7V_; zedg(dvD4~YobDJRU?#M0Ul*wxx0ULlwBE?=8L_%{I7>5f;nscPp{z=LY~b(mdO;2S z>(Bbc$%o*nY{8c3&oKO6%p*VC-1Ink!Bf{oe2IoZyE8L%FI-(3pH>#fmj6D2*o%8@B#y9zaS*y2nP z^m`M;Eze|;^~H`QA8#cXR+I1KKI$!e9{7DQJmvG z8R3$FA)4NXYtqS*Rwv@5m#qif#7*-6Hn#CK1E1Nf1LL-!(s>DtaoaxgsNULMbZ0K7 zM=rf>2I_7qN)+`%<_0s{B#VRS90)LIy;?26nf&wVP~SwvVpc-JUoK`cqfgNaBN7aR z{B9SZjoR$Zqu(q_hH#hGXgChm72`4M@s;cFy|EQ9I3o6yQ=G!MI*zHm7#5-oL%0_C zE&Xc&Bq#jZo$2(L-57&TKaI}5UKIyJq)C2D)jt#{sV#LCikA0Nu2#N8l9DiOYhS@0 zk+*g%bd;qHe4XTe4Sc=S1BQ;(2;)6FtugEq*TXTK6W`A&$j^OR*axFwX3IgDo6>^S zA|2&0)n?n1@s+_g=Re4fxB~(&OCs0|YIS^nfvBbs>msccY7nom(8slXD?lYf8-fzp z2rK_A%7=V(7%zv$2)IDK%WX2?lI@QdV|7idbE$A+_qG7_Obsiv@emdFhfs4rbt~~m zkwSq@Vc?be&UsV_@4b51^ewDSeBkhKY;czvG$Lk6)o=2>XwK}eBN%)7k}4}*5qJyk z`(`{55dsCFEa)Y=lBWj?7!f5oK>_mo^yXN=MJsk?%#;no5q)T()A#kI z40lUOGT$g?9C&}2F(8&QO#jw}yR!DNFVr9Xq}o< zgCoaN>&wR>6fY_*&%CMmn?#8JBuc3!{4b}-(s{8EiSqlKM9CQE@+ML8axG;4lPIb5 zYJyD4en6$XtGX&r%sST5GXE}8D7*SL80b5LL8t%pJA7Z^*(2`EOWX)FD4lIs1tPZb zDQ6WcB}g+46wby#&lTWP5%PMQJ*1cmb-+8*R1o260dq zcUGiEPQxw~O^hpWgN#ob+CKZv&C%kqgO2W#+Iq_!u9AZG3TU=VN(Oitedp01(5KnXDJp+kQAA9z*@&4US)gVT@9;XGFgM4F(9U_Utgn+x<5QpX-x zWockHeQmA<2^3hoF_cr)s!hL`&!bDuvyO4#7P#V=pmVLVH82(PZFCs|y~>ly26nP6 zapBv!E*ay^tg_XJn`Zy51#CE@wB1&a8Ppg0P&lk~QN#K+wEnFH%tiQH4)upFbNC&P zA0knYEphZ173jflYXRH9=B#549+i})b`BNQ5B-KOG%#wXhL(nq#3$T)OSer>4S;VC zeogg)H_Aq~$(OYJ2>dZ4GhMaMHVR5CKPeS05m8wDZ7rapqF&!pFr(!yEr+#9-+#To zE{QXbXHEo*&Noz#;N=jma}d}fV;LXTt=Vwy-I0M*V>$D@{~tp+;%PV1{l-wXOf#T5 zT3&)>q%BwcvBQ{KDB_UJo};#^qx`qdMUXcTap@|b&*u1 z$xnU?40XZbfJv4y)~ZYi@HBU&L6w%;qd5qM*i`S$tt+K12L-@B1_Ml3nbKcl3eBO3 z&H`{e<&9}V27+<0IwqXhF@}I1oW#t`>_Iuma4^Sm#g#Yae5ANLm*m2ECxougfSL#5&q^41pyX%h(sanrv!i& z(52Xk+6gBp#;v#0^FGn-(-Pc@I43ftM-wSxe(3=~n0jbn`>PMQZujZ=*~6W~(THs| zXW70e%rLRuQ}GX(3YJ$>j~{P$*D|G%Oa`4J^IDwLue2#{g1Jc{=f!i6tYx<*|4+Yv z{~+tzt^IhC+psNYeQ7Yut3zfm^Q*ZCOa01onRi;W>2A6APkp7vlVBlE;vpK}U83qG zQfMe5BL%h78U{^G?k0uSNCgO609t|^L7DuXPaR@VGW;KdGQe=)nA|A#n(vPzfEzbn zk~}z&fI_cHjm@WFP!Qmcloe%+v14HUmp*3b1IZ!t>B zG>?I5ZoHHVSv$b^kSmI%i2*i3Hr3Bcu-+czTY?XMO47qGbeC>nU`0lI*DpV%4@q;e zg0|Hvctx);nh&1QVmQVrf1^*eoWA!X%j|>gOHjNYllX1Z*CxI*elIkf92!Oej9Oya zx!36Z82WpWnuZUBVfg^fXvs%BIBBrmu1H!#?hll5Wb>|km)EKgHRIv*DEx#j!eb;K zwWKH-57}{Wtd;X8$=}gY^|O#fAXv>;ocSzt&B4el&Q(y9`Z8L*VFbcw;F z8nmK}xCiNUB8bO3X*Q=+sgVEm$rFg<6I>a6c-F`)?4d|364#|wHyI)lc>V3bWr^6z z$(7DERVZFfkQ3u1E1w5ccGzY$YUhIW?3JYb@RT56fajbC0ftmbTHGX7UWbDoA76b zvyNIcqF6*~!{+V-(v%CFSI9X&gOMjynG8W8(26dwv2?a7DI2&Dfsz>_P*RFYQ=XHg zg|Nq*HcLfuL??C`P}slAoD*Wifj;Cgx2gLPe1gw;lK@<(#Kh%Kmf`s5ip{JnGm>1i--jHTUH~=gK=-im>4Q&PAS43`D7&4 zo|je}IlQxCDd;PWJwOn&h~fcD08dRcjp&6h-PWfkbx)}ij*jDoWZ{SWSSW1_O074; zmbt=zqyu~th5{|yTzw3ZGDEu+I!h2GA^gG1{^R%D4vA$bJrF%(xwH+q#rVnR41 z)y{J59xn`@w89C3dS*7?s9lbywl@I~e^M6WPpa-cK%Ed6-<{>;Povbo`IAk-5PuS% zlr;MFIMY*?*Tx8{8TJ z;BoBntQHOD57$tfyF@C#r8#`p0ORjs1A~1U)ldjO85GK&Y(Zz|?_$Bsgj(L&xjh_Z zf6O7-9ii~)3vE0Zl2fG`28qxmVpL>x(FvVtaX6R^gNM4ysZv9i7@KiYgqefrh7*;s zom?HDo;ptqr9op09l>bM2bM@l z|629zF+$q$8aa$^jra~e&~hAFB%@kEPgK(dh9iUqSP=4s z&PGxsvy|ZU7GWUT+y-k8-l8(0!7idW)Wc6`iUU(+NMu}+ycui?bVwk_H4z=UXBMGb z5e*?G!|;Xr$u*znwgu(R0!$S<Ki`k-W(%Mj4AYfpK%6AHH)=x66yUB zNXQ{A`Er=e&4}upg&QUs%ULWMDPzcu&M|@Yh;M42M;s)9oJ>_1DcT$d)~{7fJTAZ= zhKA$NF%uR>=Gf?o93;cNbs*k1HE|3SVKx{4_}yFG=9J0wqaDJ}ojP`s_OLNs+dvk# z5GGVV?efTA3Q2+_{$Xml2+EIFvg&X4BtkHed^Nyx^Us?-=>d4NCu!d7Nwhb6(t_`s zGBm*Z$cEDbZe>zUPS}ov1hAmVpbMtc8yQMdz3c#z65JBzZE# zFudkam>0r@dc#|$wJtVWs}m`-?tLlPfAC~B)?FdA?5lWBr7~?+14HOPc(Ox@K{)~Z zNiL`hbyOU2iwt8|1r+tlgh;{h9R)Ts9^aJwa0w5)x;1kZOQcy|F{~uEV--s|d|FJ8 z*kZW1Ads^b9=n>`yZm;_l^Ur5rbVu!*V9m_=5V(W zEV}aZ1~!cPfdnpj`I-SPi}G0oE_-#)1TKH`+8Zvb_(>dvF^MT!*uPM%b5Q#tNOtK_ z6h3YgYq(#D<`&%4uxOp#`%I4Mw{(X_*!u@NRFveN892NCYywK~=pLh#AG|b5aEdyx zosvvdATZkH{}L&1e1?$SK5~a8pm8upFE6H%-P!hgX|rDkW2}gUoEnYWaTT^*34&Y zA7?pwZC=U;GNg@4`0H78c?tb>Xxgd$<-sv>C2Hr{&KM#D9LVH=HKj!ZvTJ50;7`%x zjwY5-iJf6UH5NJg*~l14AMD@K3>yD1y!DB6OdjXtucE7Ob2Oz+U(&C<{}{!reY7_? zlOb<@CV+&8w#%DT28(Et82HJi%!mmwtaGP|_fd|rifN6bhSJWJZUo`l9yIb`40E(^E50hFV$dzoUhz!j5% zd2jU2b68#CV(dpXx8cyUZskXd35GOC&90wQ7p~vH$)i_f?8q!b4a=U$zzn;-XL2pD zmB~I)U0H4r8X@W&8BNo%GFWWR-$1@FSr}XF>0Astjd_?*EJ(zXMwzS&ByAmuc#0HX z8a!){wf=oiJssWEBTF;lHaC!}vJm2*@EY-_F_%VBezq68;|Y%3sM-+qFA>Rzl!^L= z>U;o8C1gHj-{p=5!mqKg9PkU9XH@5)pnvEYCjxP6))ywhT=s1|7=aY)00tJ^A;E#Z-qUb}U1<=N%Mw|R6IBRkeqD|VLaV1oU zLd}dwA@JQ7Pc4;3vLId$V*xMlZxTmHf9qu45{V>3Yje9O8~R6fI8o_$PskEvqWtBzuj(`C8@Cd0=! zYts9lHCYF-CcDE-%y*B=OkUUa+g|ynf8bU8z&Ts0kLTsHk%!X~7Zf>F5!g(gZ-vID z|CEDBPB5cq+#NQOw%9}SK|vxj_n4)5hVfL|W{0q#7!xdem)_X8)NY5PVS0!Ayp+a8 zeLG1oDWfW0UQ_%?Q;${bOC0Z8^oZGaVC;pEFITwn_xl&oys4~KgZ4y*H)+!GO`6m( zV`HE`CY01MV})D+wY4|6K(Ti8N{cdAavVI<%NKI!Sz9G(3m26@%Q9tY8hL1#W}PfN z!U%P7gkhZ;x{@Pk4Q(r(a`~%hckB@9OGKVc^+FsgT-XpzI($lOD{lm}y4h=Hqc><$ z7XnR6zd@7dZ_uO%ER>6cHq;w5xp;Oab_jtczia{xd)#dUa~;tlb#X-zjy|?&0+ywm zl>*_5@T0o3u{hho??SPF$ z{ri-rNbAp(!WHI&?0$9hu!+}2B@kwk#a*5Ec$u=sZ&Vt?QQ{+bc@<4k|j5NOuX^!-9XUq39l9;<@{_TV&Y%- z6lg86oqq6IZOcL+Cl8I@NE?*Q>71RVb#$ZY6pY0X$0*WHkUFR3aigJG??R2z39xHK zEUQ)?YM!7{z5Alj7;)5u92M%L!fsk77Kt2HHNTB-mo+jWSIL(}F?Go7QGtb-XK?N% zIV_|fQ(`k?7ug^jSS#9V7fxa7eM)975)3CzCVV2uE3zz|D-5A{ zpbiw+0>lt>PE0|NMlpQh2ObGib`sP96=O;op?X#z_Yrs;VP6PlWz8W3*FuCzF%#aw zZ}>^sJP+|D!)Odb^wl+Kl5%4{i{M*KFiPcK z1N89OdX1y78m{6uiGzJh#rYT&QwGs#Hf(UxsAM~~X$fKQ>YzSMx=7fH)}5j!M*FMa zhg!r_3Nj**P^SD$i@C3?V$b1drVo5wE6j~%YDN!+UoRvdU*C(l5VdLH`BTmkEmk`y zFG8O@`Pg6+s$(lE%Xp`5f#Ct;mMCLkC1TPjF{bB4n_&nTQUX zmmHOJdRT|;`d8$A&{tPkb(t)dsZ^c!FCc4hcg`2x>U6&HSoC8J1+zrnRp5Y}Lq=Tk zB&m9B3)7seod!yD6^j~8*q}azIpNkj1gnfaP78)u)g1}$u?DYkbeCe@PcsK_k|y%D z2YVEUQuaV1DRk=Hs+c|!7BN>_0|l8*e!mc%6$0 zd-waowy!S}55h~P^rx!7@si9CUeX?9X*eV%&WHzWo`b!ExtpY8=G=YbC5zUI8R{+- zrn`LsQ7w71)q=oEc4xlN^6K9bCjH|3p*XDxd#4R(hw#N1NGmBrz8V+jFPN^)S$F9e zSc$-dF<*6YP*M049nk7ZIxOL)z=?;puPgm&*jG?r`7LYmi{zKui!8BkY%j&d;6Mb79m4;MZ7xXD>9WKBD zogXM736)_%FBobLyAT=6$%|5YXu`0^mw9f_1LKa6)Mi16xDysCfUOp*NH-_VO;<=V z9~)>4<{I~8uchELJ>_lVAD^8MBg@})ls0ESy zhW!oz8`Rii;$KVh%90XMTPKJqHzrW?6k#doV!t*xrksKIuIg2o{K_=wz`umtIWc5K z>Da6qR&B>gmn$c0j!@`V=#o4RPBJ!l5{n7P7qo$ z9YRZ*Iuqe&0C(8K2+W~s|A&?g@qo~hEl8Q{dVO*>%GYgpAKxXHi?8C!*jeFWs^|sj zh12KN&^Wy$(0U38Q7~j$UQd$97i*nbkBnC)+FQCLpvY)7l&q`UgHL}A*)!6D40oYF z7*_H+rMr%k0%Z}s$umzA zlz;yC_e4jj8^%-&aw59N?Rqt0bVJ{5tFucj`CDK*yWSTSsEYbg~ zH?vG>-#epxF%RcN#Vqgocvurp)nVG=;e~mpm%C>Is9ZYs#}M7v$$it<_nYbM8q`N~ zx(g;IZQh<-IujOLB@Z8878jA3aG6)JQcfond1>`)C#Lanl{Q-)X+{S5jxiiM?r#;U zc*i@|XAAl*K^9wX*VbLM6ebyspLL%AwkjD~`zse~4~MV6G&ar#gwNm4y6T6ww%}b> zCwJ|?v-`=ZuqF4Ey(0HF@QRHsTGb%Ytxh+Gm)G5$oxGr`NVuykY(91m$E(k>KGiza zr_L7Vmx(-Z^eU&c>C3M5m{6S~t7PS!T8CDl+Od~H_8FQ+0H;oij|jyE4X(Pf7jvfX z)^}twkfl^>^HslL7~ZnB)|sp2-SO24uNrO;!Ojur3nT!Lk+ zz=|<7?3~IgkwQa57{Fa6N=CU+@6mC5~ zEZ8#Evf1KU?#Z)ib<4`zN*K2a$7Rl?pnA^irMss)Ws&P&7DpTJ_I7VF<)2$bj^hIl zjBDlNFuN~|Yk-PJR}<&EbaiZZ)|*syTQ;h9j;#2JcV%2JReh&NJFl;ls=YyHrP>$*gxj;3e6N$nSyot=BV&tqMid8G~JXIxTEBEs1cO*j&u~VD=vRRd{eKFCu4+KJd>1> zN)xFHt!jv;!P?8&sG8DEby*Gd^o{bqCkS-LX&n>ibay-zzHqqM7vCzzCGNSl*5%<> zz4h-49?DHtI-}xq4yu=CK^cD%KC-DHJ2d#;K{ z>vWGb+>*XEo|JUfgY?ulIrV}jukxp~c4MqV`Qys^gT+71o{DyDN1JZ5eWU!!c#o2= ze6n(@dl4EFb5j~x40D3cnn{%*xY#nU*L-B(R7A_vot@puT4jmtZoxPPo`D{~dGnXf zq4d%(?ebfk(-l<4(ZjBd^3c2S`;YTe)~|X((j+UQ^K!b%u*qN4Np}m8yYg1?-zQGL zcM(m*$k+dU7qL`XeRrv))kSr;=qwu<*+nA)g2BIFy^!&xu0!_~v8Q0L+5*RvW1Q7`P;?8!=)~@OK1FxGI(y#27g$juR!4; zecQ1x^Jpy0i|C@;&xm(FEa}iJxCa}wqu)TP0YNxalTW~A{3Dy)^lO(;du`17i1>!$eWJ?y4=Jo^RUOt* z0n&KW%ec+eC#6Tt%FL*~SS=Ghk5jcfkuH>Qr6wM+D_Ftw#|)e;xraTxZ%iEaX}c#o zweHP0#46`+{E*_DljrnUv?|IwIrtQK02O`cVhsxM&1VtaXw_F#YYyuZpcD3wl1)LH zR%)+;pd$)QRM$44I{E%K92Bi4C#LD?8M16|;53O&(-Ln+c-D_+aooERY36zM%Y6Qq zE>EAfpKBAAt}9sU)`w+=4XH*!Hfd*Lgs0AQbtO*}R@TN!^(;h`FH>ihy@qW%E$xmq zh$_ExGl!#iHMdN5;v{(@w$o+;uO z$tz4F-kBG}7--D*iaE#SiBs^r&Vjww#Mf&}4S`Q$&EKm?{E7Z|U?|LDcuv?piSYEt zLnZvu*Y4uYS{Vsz8G>?0`+BMS;V* z0;e$ri3nesoqr~y-HVZ{@5c!Ji3uzxt`KC&IitFiUdq4%DR}6T`Q0<Xf7zddWENd0a?i(pZKvbsxoKT>|gH;sI(@;jxLN#mEhC+MAtxrSo z2jE+zb6*ymmR1Rh7suY4mG;PpeS;RvJd(Ky6s^lg&S(2_`)0Q*}G7%-5OTMkRmYIngdtt@ST0$~S} zsma+-HIs@={M>N=qYov9aX`ZSWr5b8f`IzWkc;J@xzo^5w`wO*gW_Ek@K~?2`O7eh z7j-DGxi5%9VefNs)hr_^x#E*x8JA{HcV*dASAGz|!Ws-F)(j?I41k|vrs0R1lzsgd|b{5i`F+ z|KFZLaecxpc2C98Q=Ph_!z#uJ%AVGHdg5b!dwfL~c524&2Lw?J4l)?G z)Gxtcq?c*^ka{pGGujN9fGXXxP--;Cf?LzC5`i_oX)>oo>PdE>S6LAB{AwgLlOy-F zREFkzfabGOU>EdJo&x!BsuW9&KV^2P5m_x@H8%~HEwla-KL28QRfBOZLp$@f5=K%# zcM^pl9k0w!Sb%k%pp9hs^ChdxDFTMRd_FYdG)O4qAi*gZ4gnqub4)lJbzD8XD5x@e3Ux-UxBS>6INvV+(IO(FiaD z{bRp;jTIDSc%1QT4m~Q!30@GvWXAOS<=08|nm6MIfwI#M;_>ghh;l4EjqL|&9uOj$ zA5rS~rmk__sq$Fo^%zF0Tp4h4a}LRmYwC0L;2k6CTWK#qrVVO)g4Ud#v5#|lxIN|& z2|1Mw?29sPscEw>o|xWFq2w#_wZCAAw=F~=omP`~?Wyj*@0SM^WL{aA7$b~n&LGg; zZ(xVMRwQ$8+%VrgeeYD?;lR7GRh@^Cy~DU~Bu^aN%pp5#)MMC5f=xmacye$_1)uMy zj!op5oy@>>8F8h24;w^>M3d+7(3AWQN646lpw)opu&Sb=JDvW&7*Pzk1F!lOsvDvT zy5=RL-h1>Mwf0=E(9s11q4vvo%r=Bm-9q^P$BH7;QZDMl^7GUc+zM!UonyX}`Ed%# zs&@olM6AX#Zibx;@`6viXd!q}*w2I%ZsP<0$BtsV0#1GlO%?lXZnD4m2{`kS{*M&( zAJuk{T$uVg#etx0*+A3(G^A+f&&8@9cs0?iMvYKVahcu!y)KKmDJtJ(wCg?EPaVwN zl>1+o6x=hp${kwc6RqG_1-F|0Wfro17>f1H6{#>`ast1~8z%}<_j}`Rr7O!J6dKz^ z`fy`yu>C|fqoZJbk>5jso~G`pC{4SoHmaWO*3!KBSleIGg93X8S%7~M=o`=rKbwOP z2p99`L`?T_q*lJnsIu^#rWO`=dE(WW+P8rS>`~zn%j5#Vh^F-+h>9ML>pH+}Mkx}U z9~56WV7i%>x>D1)#+m<+29pnucT#%b@H&@RkHIyfhjRLWeNq7C@Hrpsr~zm-sP;E$ z0DrIMR8&P=FCtxzm+6K{?SQtVPDXPVAuxFkc zKjJDHg^?{=VJY3)zha6NmV_rHT`NdaO1<-a zuH-dV2+tL%^*j8~i(^c&BYfABY1r7t4`-T0?cjOU!#nG$B%QDEMwYlu2WDKDg)q)d z=s1P}n7O(h_6XV_9{G}_m>fSN2@_7QRGGJv=NH}L^Ertt&Cwr|M;qF{Acy2waPK8; zF^dzl??Pv2*PiDbs>*?`B$D3t3Y>Yz#^`BYSVetavuVcYXCm6}!up|5M@d-v}TKZ3M2f2saLqHySiN+mztgC<&0qs;lec%CeRC zq?odJ6MAJ_OC5q(G_{v)W!h$OcX##eG%2V{lG3_jpB`lfN<7FKr;~=hX%`0u=GQzJj ztFYD5tkgOCDBC~EBuvRpM_S(Hs!`HovI=>mUo*4=*sRiv57x3L)uPxnsd80_*a|ij zS*a&Bc34#G?qwcD!FnzdHJ7(Am8o(0{CviHRx8o}_};lg zp!sdr_L*sIbGo%m#gw669iB~`Z%CiLox}EQ)dFXqa4sR8QLrPAS`b#F|4d18^cw?e z`$~VrEu=Y*y^IiZ|0;+gooK;T(`pDk2;XWCA3QxAhu0Z25dVECN~erqBlAvkqOtv9 zw`;(OP+dkwkKI*&(+!Ho2!Md!!A~0r2o*+my%BYeAMqt%iDw2h3~^%k6k4?}!$}HE zNOkDe@a$RRG55>*&<5&EA%k=%DqnpHzkkMq3jvRke-5UflYAX1zB5~Zy5COrY1ibi z6XRn|<=%$Jms6U#9^%!?Y@^)+Bck_ukopqtfR@OQ+KQ&vUXxPOce|0f38ImP@&ZEF z%EmC{%FT-b*m57Px_$(puDYTkCRWv8YoNSQC_fP*T-Yjt565v8D*$b&ESQd7+Ptj^^5EOr%h4Y{o719{_{?UjT#U zUjT#UUjTzagf`&nGFBZ-=W?yxi4px+{{(1N9Y9de>4as=bH{SRm}aqDC$~9Cp!0{qRG;xP={ATs z7}<96xbjRdsM<<4XrglVZOc%fmWcX1r~nJjY|h1s^I*#4#?McAnLF_1??W831E~$p zQS`Ot)1kqO^`+aqfWF}k&Y|?2oZ5R)1wFXkf2 z#%D-vg$Jtqo>6G>b_X)1x)p*t$cZS@xdVd4&&gqjbHfg ze45h}1tSEu>*LF#>dYv9;mOU-_R-oF8qu^Mq$Ju$0`=7^If3jJlnngf*GvuF5UONW zZi`Yfs|fj%dtjQPbf_Gm$C^63 z-irB#PIh?gJUKy zA#sw%3-Enw&xU+6-)1TKANs;cLTGnPp~)$sP^vs6*mE9cj_w}U=nN!S83QEa(%7~V zU+gL*&}*&@-aJCs=c+6M>c@bm1v17@!c=#OkYO!+oYe4jA%B3tPjk&Sa9AsQKz})H zJhL^6)k9oNh)?xd9!@CByxZ^3*X!vY`a9fl+bTIO5hr>s;M$JCaogmXNIv4SIy^JRmrNypl6T16T>t zWIz&Abs1w@lMhG~s%rV|xkUz9gtaMXiC%WEM0H`rH|nv_>^t>A)PUW(a!OS9soF~R z)=aa%?1i~z!fw|>b&{R^l)?m{U=u8LsPhanV>?@}xyoI3r$UYa#51Yy)1`AMq;bK* zCKJ(uBo}K4zY7oKj>|kj*=ae&q`(50Bqv$cJ45b_t)q^0tyO9YW&;ErqM({fz{u0g zw3U%rFx`J3lN{WgE$A@P|G6|eRJM#a?lur(auSu##$ z`9@L<57nA29$GVl+*_*67t85*5tFb`AvHakRN5`11%{c%(s!?o7iHoD48I5K^23Z{ z4!h5Wi6tv~XzP49RMa;LqvmU=SI`Lc*LtknjKP z8DS6z>Hz{nDvZ#F0{|ceL<64qzCs`kXNUWqBIeWYbpvi83dv~_fXRy@{0yWFlt%o% zcT|t>2%?w-BMVF|s!K{V|Faj77y%W--QzCNpqXv;Ceggx8dTT(;^iISh0@G)?uBbE{%S+^zANu?z~N$I!(T; zcK9!D9$3ab%q)1&{ooWh@KUwv!$#rK*%-SD)kx?9)&La$v}J;)Sm@*zE6zp|1Pa2D zuN`f{u~+s8<e!K~377Q*>ayMf6+{KG$;Utq06DpX2mrML+ za4oF|^Wo-R(nVVoj>+Z_jFPAa)sB)m=z9tfTKArnQ5DoY8ZmiVja7`bQaD;n)##^?B}8tcs{R%E7*uJ zC_LKGLX{f&@c{mizfI(aIdA;T6`Zv6h%Qg?iE{a=k8&?}r$-wcjD4}QT+4bBdZNB& z`9P{HM)h;+#>P@AffquYpSgjpKem&-FC1Gc$hhn^3tJ*7;(2ID0cZrP$QC|Vijm_u zA1VYZX@610j1``yRA%AXL9|2c;hEUGLt+UrK2`QTl+L~p{V#Z-O%mr(Ev&oank!0G zu#C`21M(YQDE=SM%wCkM>i;1>h&C+`mJ&hSkYWF9y4NJ41SJkg5`xu~y6S^IW~-kQ(!@{zO;6C* zepnh#@ID_3PVoGmQxDYwDd)VDXnq6@x&swrhoD6e6XPy1F0|=)!id}z4Hnzb%5@nG z-cHg?gnNx9wn$mvO8><_Pm{O;;0AqEysf#0jlORg1NAWHBC!KTCoQ0a+OE`r49A~u ze&cG3O+OIou1%lA@7Bw8w>#MtutIFes7o4B$gh)Y0$**+5;>dHZUX;<2NyoVMT!y) z>n@g=nE4d*gx+-hhl2dHU@pJ-fS(~eaD~L12Y{(CRDR4Qn~E9jwYpfi2#-OEboNyK zI}QFcOs%O9bK*(g_mF~@Tq6SuI%HAHcT9osp`~OLG0@-aSYHclO)fB4xtjt`4)Ouh z1QtnAvOk-;VfPO``8Kg?w@WS>ONo^pEhSgitae*L2|*!`!L&@$1A>0pN1O*#RS+7a;5rj)X$5wR*v- z{pmM!Rio|rYkSIlf_x3n+8mYWVvQi=1)AgrhkW2eK?3SvOKau8W{ zE$;tlqFPrcEY3`va;{Nwr++v;0=_UWr^Iw%>~MJIg$Kc-Qgii*+S$oDwuy8tGKzad ztv=JO!}s7^4#X>F)7lxIK>(;X(h}^?sh>PR{g{|q)vagg)vp7Fcn)~Ts zS5p-VF%WUehAywATU{X0CKMI}?Z6fbCQ^5*JtR{dtlia3O-eWQd^PR4K9=A}a7KlN~}iV-yi>=lGh_Y`K*F*O1D_WvehSdcF^!vY<4P zz9KM$iL~NRt6dCWG<08oSjOxI&ix1h-9TyphmzHLR6`Or1SU1XYYq&LSYwa?@l;>h zEP!&cL{>mAxxm-wRwr@^)1jq0Y$8M!m;g%2CL^NitDIf=Z9OmI0#2R#d zKI9GYAso3SL4FD$8Dx8^emTP(BtHb7zII)X@VZY8h)3{bgxswq#Ex=)q&>t!KcqRt zqK%^B!K^?DslYraDQcKLa*tg?(9OphAjmF!soiJ{e=#kxw%~q(nLeV*StU4%H6$Gbj+yooUKcRhlwK>}K|M=*$fLDv1kOwokEPQt^+MEZxP;w0Yc*KyOQne1`yN8uR1L!9b@%YU>`B1h^6EbC51grmJY z*8o4lEESxP;Ya|YRWnHyjdd%yQI+9+D`TgU7c^Hu1R5w1!o5?H^%?holaW-*8*`QE zmBv-|9Qv*VBhUrptu)J?UEtC-Ef z08g2{&(|LYWfc38DkvtTR3qd677z3wHs6F&e5T8t-~EAjgYzf)xGNU{DQ{EG=OmZ_ zOi;#CAV(t1l?RY`Y+s3eG}xU7&}f*ten4Ji{SA`5&y7DvBF==ei(9moUK6D>{l&%4 zfojr&8?eyk#>Gzt^&uWeN)?lsU5lb?Bo0c@X?_ffp6ApEG#U4<7D&u^Uof3VEYeLC zu<-5?3Cich#X}8Zk(%kz4m7r5;0=m%fwhVT!%!MeM@~$COAlWiHcLO6A{Wmn+Z7hq zc)JBQ%Osj2m2W;9sU`P$51ccBDtrL9SSSL|VcL{i;QdXBP!{ElGoo;%44$w@l;VJMB8k1S(Nbt7{^lV9IlR~)Gc(&&lbbI`k;N;# zmsqJF#iC8N<0B2#4to_ykT6! z|07x#S|&wUDxKlSf71y6rV;*4BmA32_&1I4ZyMp>G{V1Wgn!cr|E3ZCO(Xo9M))_4 z@c#pia5MA$@!xfXKu@Rkzv&2C+MAkR>SI7dgChgNhk6Y*OKE4$W{v}Bcn6pN=er25 z{D18t{_o}8ZvR3Ktci`3o2ftWV$SV5Dd1G0Z9M)ba*(X@Pvqd7_#eoD*MwWn!_vT^ zmBpjEYljs)vvD2ot>jJJAIB16}L-DgkuRz zaqd@>BN@nlTFcGlebqjU#|TOABu7(7V?gea-yyyhCo&VwxoL; z2mW{e{%ZYlk-)0GBwf$crtU+^!NJ+$?Beisef)fF%rccZ0-FD#k?1)%@Nlc&xZrpDsWWZm zR)XtU8=2_P7FrzOy}9!6-@|^`v(${TmD>p#6&o_=NC-q#p&{o;jD_7_XyIhkEf4Qi zZsN0BTnqc6SVXq;s4aJyDnqlb&7})s@svNx2X?GFF>XWA@US$cD?zAs+lq@Hyfd&f zJbt^}M--3hQibd>A{ZL%D3rL#T)VM+Jveo?533&C-Q3KnS$x&P>5-9H_$P=| zo>ncW{8rIE#2$&1`;T-Vij30m0KRDN9c|d^sdkGUsUwZ7SA|^TP3sPpS<^(h{O2DIfOrqdp_T_9u`Kfc^zD zHeBG`V|JVykU0vz`k*=|7KyAB10am#B~2aXZ~#z~$zoI0C_}8xVq+wn2HDf&lV(uG z#KXeFEi4gxi}&;>#Ak=&yGlDtZd4Ka(IR;15(0Tqk(u|p6#Dfg@z?5$LZ7ykY?f4LcH)@>7bMg(bOV>)EW0_M z^i=Gz27wEJu!=_qf-#^bNvz#1JLW(WMhjKdDDnkJVG5&kN8^IL!0p3X_Se8eSF>4Z zdGhHnzp4UXP>;`LlNX#O;CbdW-BJ;HvjSCXoyqscrMynX5W?0-_#3ahVbj2*izcQ&@{GApvZmo z*&PXf88*gXxf4phBn$3QANl!c2R$kfOwtYyi^HA>B(Iqp&_^KNzXRU36&fZ=> zPno%6Ct`ZL4ilzzAP24-s9I?^x`n!3lH}dgvxyOUDgzMCEME!QB5OWtAf)EDc>j^7 zZoDZ$*#Berhzd1b4(KyPPrU3{+|As7;nD<3FdSHj>sIM@jA?>^svp#z#F$z9@ z$W((js}US|qFe+YAL`AOQHc#*s2ky-o9MJ$Oa#-;@Uiv7VKpnAXAv6^JhLBh%PSQo z?vWiwW(qv7(s7rxJI$pQoX6yRA)9;sy;q`fdT^R-(?@io% zjvC*LTPm}lBd``xC9jPMc7gG#-xzcu>Wo~I1vaSS-iIq# z`JcT$K+XI=d;Ojzg@5+?erF2*v)6|qE&OM%A1+<^pL>1M)c+THeSiYRzj}Qr-KOte zfBVw#U%h_zjp2Xv`t)x9>h=41{(G-4sPk8^KQ8-MuOIM2_Mduvk?j9Puiu;f-+FyJ z$p6~wM+g3`*Y_b1`K#CWBd7e&y}pb5-+O(ind1M_>jMNU{qK7H^0B{q{bQ;BMX%2^ zu&uTSI)ppSNYf2WFVvK$c*jPqZ93lXF7JUmg-jpW1wG&T#gJY!+GH{fRDPtq55U4{N@WzoA2By{FlzXO={?=M^{r zRoH7|^X~K4iu=-GVXWoU+lSD&^RNG1k>6;wtdNfNQ*uV2#S4weG0 ztIO77O6ZQe+*uzXo?{)fUkxhOfF?d>+B@S7Duwn(Mh6#3a|_4IEl)q$$17tDs`|=m zCPaj}JdDQ)n739=Q%(gYE>blR%WROEP3L?ohWNJpt&GC!k-T3G)@1?dE$*7IhxiVb zrNydiBH+1oU{pkhWXbk&Iy!Z)>nqCH{9DqVhz$(Ag6>YyhStn-AFLL7+IcBW(;5<6 zq>`}PzgCV$p{i@wSg;;WO|FPccYCJRiEMSX!R| z$HT{6e^9W?Eu&}kk2+1D|H*u+2WS*Wc0qzZFLmKq&y%o)>w_gPmliB|-;uV!3>)5f z`zJddUDBVLaYJ4l#1u^$lQP#D_Dq)#9GBm{^;~pd6IE~%vrUxOq-*+)%vlkUL6>B? zvYKkfrx!8PQg=v!MhDNPhFKWVSH@~0>&P0X39w95bGN-g7J+rsYWev1FY^?WRY=ZWScFu#^=%TuR zrTl^#^=KsK`cs`;E-G8A7z`!eF#w4Ec{Fy~Dz?}>gm-i^p*)vnOD!_>vP^V076*1>OW#$lRhyK#yRtwpJQY^tZ$`uSVpvi%&QGpL2@F-`QEd@`TBD1kPg_AG|DoqIF>{-z!m_RKNr=6<03 zaIqy}%-yU+)Li*Dm1lmZ+00O?TRt0I;J~x+Ny&M%vD;nA6?`~Y!1G4&FE4#|l{9$i zojnm)#u^SZmGDy9;%c_Jb?4IQnz)_nWM;C-({U3R&&waG@`N2=E7vjQZEKGTJ-r|7F4#z8-Jj07n55)6_9QOJWQB^npLQeT&+ zLgNqS$YWqr!P}79LXLA;YiF?oRaH0qOMO)R1n%jgxPbfcSHthmU3`D{&)sbUo1TP$ zUv2}7VAy-!*H#584@cm11k?dLwR6^5v#npZk)*0w9V?bLi#C;ypUqE?yXQ^zz@`lq zZXp+;=a9-AfTxbii)J|2^~0xKiJrqo7F~uOphn+x!d!mCB9Uy_nSR4Ap0;saYs2kc z(hId&#m9aD5&wL&yld4nws$^wu3-F#mUh;Mm(z`#hh3fPFZU#4Cf93_2Dd*5CKng99>qQ^ zO!kXC(<0=a)BY~~H^o;4epzx~T+FXqm4Fei_tOZk7Z0tyLz*uT7^yY&m8!ff4a@a-MW+vhvX8pgh4ouKla=cwJ6x+xnhq0wxjA>yY=Zi ze|>n}J%4gjuEbKN-O^6stqNkCG(*WM@V9UNJx9^uweIBfq(=|CtjHH|8h?8RONMar zgM~KqDk2pf=ut!(Hrh4MIB6&LCNSwB)^TDA|4gKUzAua@P8wqTVu33aU&|TDyw3VY zXkK@9@Juve+@#v${@G|a^+7d?T^%i+FwU`qvQ-8@y5>^?v8eBrN;nqetO|kQu&j$T zAE1h7aT=m|LFYp+TgCe#NKxIt054n@Hql#Z+`JkLMNi3}gaO;@m zOjH7j*pk}41?u`tMuD)p;<(6?Mlzep$8LAUMo(z3uVw-G5?NRJ$0`^c9o6KpB`@uaa_}2ZHLE?ny$1SF_2DtZe(iluw)Z0Ognod?%nOnnc^YWp-r`O$N z&1b%jm%B#QJ1j7G>H)78E$%mI5Heq47>s9KxgYy#Fp8m>&r!GPC8L2CMZNZMdSLNj zTYk=>J3~6LfHE^ncqPG%162x>K>$?{{tHhqJN)CvNLu&@mh-Okksu1u$)p4U`)o!^ zV1U?@k{__QgDm;8ho}cqx0Nj8felffR_5g{(G1(z3A=+erqx zk6P8StdCxmQw@$<6;suYTIIr}k6NXog^wDdTP0ifhz_-;axSYbF}9n}f9hjE92IIk z*g9)XrnPbF_pP@Zrpd%%)tD$5rk?VzXg!r$75f|2)6a-~y10HcAr;c|(wLyKi7;Gq z8oY_LLqov7Bj`wMklOvCaGdIUNbkQuT2d?(p>g3Sw~sA_n!RNjXM*i#Dvc|BJx5PF zI~9|}+bV9oMtTvcm?qo*K@yy{w?wR+wzmjk%esH)vff~=RTb&}M~$UwVTmuMDAf_E z@pD7vHiu0(#w3%g;Kq1U0);Te^-LZ~{jfzQRrdP=LJKaX=^Jy)H!-f9-Vsu-#)2Fr=7PlALG|X*hy2WRT z;QOAwFbK17#;6c1;7@Qm1`#na7hQZ^Wu-nC00eqMN<)wbKs2F(ae)T_s!i&hGHyQtULKeWQc>XwL2h)P*_U0{|oWpF~J-)%dO5*uAjT`cJ`&H64|km_nG@ zMCPg9dg4mOfnz`*!VNp^sQ7fJ;JIA@H1d+z{m{uf!JI%ZH2knGf*hTD2J&R&{-9!E zHd8)S{8|p|5S2jn{YB18mAGNDSq(l9YD)g$%H>14q?l4Zcwy!Ul_oqfn^(r}FORQ= zOzrKv+yP~@BxN$kmaT>{dgrr*s+$vM$I8?$E3uTgPh{Dvok zL>%}hC-H2AOVZIsbIhe|SoA1Myn^hOr@~$Ydw9H8nB1ikw@0B4xQP2{ zj}F)-NQsXhUS&xus}_QYR;xR5Lnh@9JstPXj@ls+p&ql8!@ShFT-Xy66jX3=N0K;_ zEaIhbFZK8e^?;c7#iYR!B}~@J-&gxjbwNKHgo!K9}GrJyvRKw@X9 zAtNzNt(J#?vlj@Iz&30w`vkAmp~ed{ONM!mnNYfbfhG{gNOMbuF~S!A49eBhGNXqq zb^#BmFuwh6qB4O2Uz$140^5==?5AX;kSPwZj;izTcR=HaFF13d0Q+;k4>TBeUo32G zp&A3u%8rLi4k51J9_NHnCkE%PkgOOmegIXyzn$wYMFF;NXQ^I**ZUhg?Rg9|`^Qiw zWU`&*5NB3zH}wibeW%7ax`rpsDt_q%nq#!`B{4CQkt0urejF2@%0pZ{{eWgK?Rk&2 z?UXPaWmZ1CZM5({CWNtSN3=gT>6{QV$+<61{!V18z#u_SWGx^(QP1X8V~IB5D1*LW zlUn~En{qJ}m27RDF5!a5wuFz^r_9i9&9WkIT5g0&V~#zY*dGWO1P!9yVq0rMU0_QYPXCVYZJ6(64=jnU!`W zOmqgtG<@v=7%fWJuU*>`v*C~DawW_nC_V$PwX6I1J_#1m9@l&&O-lMihP)Y1SzN(| zM5u5hDF=s4>PAY~rj^pRUromhpd}31gYt9XbtRC!Dml;yP6Xu6hHv)16xH>gd!-c-z zJ6REvVkH()c!a4DLr%3>g3MUP!J79F;)Rapi`x)C!pr`CUZT{BBd4i!=M8To0kQk! z8TUM6m^@ifoJWx}l9JEQ>+R zBC;XGA}$+5EaHHkBF1*X87yKFoPi=H!9Iz&9;K+vKN-Y;K`h4DkB=c{ix*k^VG!?g zi0gs92Z0zwQ*Al(Xv5gA$hoZrO*778C)h069B7ELbPYUVW0_B?Zo;tu0(sS8Sh9q*>QI(F z23-|DW8E!f3xaB25KMfTSTdRU228^h>%3?ahRXFC1{Dl!!BjkwgG=eYP=b@Pz!pHt z0vpIE3zIt`6c);}ASD%E4a8K%C&~=LI}H&A=oB&v!b#`16tt-;3k$`FO%dH;G(`kO zWp&2*gE_{YT1pr0W4L$I%yT zS&hCFpFd*yMtUi`g{y=br^XpdVB(l$5!;x+qj1U7Z7{IC5MVgO9;iV|Bq2D3x zx*@;C)_qbdJ3mD1iXRMkMc!iyGA8Fi1s42Syr|FwxvwdtKqi$tX$YTEkTVkVEd@Ds za2`_7^AY%tLJEvuQAmMVZz#}krjUb>Gha|>!*X6vAi-E%8fOuCuP3kwtRhRCMdZDo zz#_Z{6xuM{QuXCI5yjQAsB-S(3Fuaw`*;Ek-{J8DTPo`*1sZNDARI1=@AISrh|YRh zfre+jtU$waUREH%N*tWCC&5|oD$sCUULXM)&g+LquvU?|k1L3%9o|>4rFMC3!4d2G z_<|vl`woMM>iHA{mdJjTLB{oXm_f((e4YVI^na+q6beo0#}90&(3m=VU<&nq(7}?4 z4C&uz3Pq;Wud`(Oz4`zJ-s|}XOCCQ3;Yepa3&CS{ei$N>-R-dmS8(^&BSPW4+^QPo zOXlY{&oGnDd3r*|?eP4BE!F!m3Rlpy=8o;L^zLs~D+88bkLNCQta4KwFCRq5Z(s13jMpzjRQ>}PDpJk5qm9$> z1q>NyD(Vw9#;Sp*0GJ< zzg}2Rf;64RNp)Lgb@poW+u8PJd;1obxOI2$)~z-T^$>tk<`PUx6>a8Cy1LG^B#iu7ivfF&p0IlAC5T<9-KqVDC5!1JMpd`9SW3aU* zUMspU$Y5Kxit5P~LD>6RT7iEo_%2A6!K9!KHm6mgZW)Jv5{32J$tEe!NIPeW%v5r2 zZmKh!VQ!wjV@A9;D7>;Y^>`86uT%6f4o7VN)r!z25qAruyTcxuY(!&o)+aZG{ZH1- zY~#<=$YvPK&15I-8f7#6&}b)}Wi&UhRGt}5uPi7Nb&L|u?bMhoufXyFhRBT3i;+_g zP!0ap?xqXQaUHGH+S>q7sftu8mNVSODTU~pN*Vnf>Gfg!J(C1emRFUPE)&q{y01Rq zjMys5e6O)oE9gq20sUDPI}O7mh4$NKk`(@-6yGVjT zzxgcVZoe2R^+{rf1S0c-fSqHWs)SXLaniEtVy6)q=giw2<3uAYcZH$NDtfLJB_ipt zIY}^`C;^Mmos$sMjS}n*{^lgnNawYI1Pt>=<3O7a&X#b)f!#5wMmsMl0j}LKNns^S zn$dClr^(ba6Wh5=nR=KQC;RqKjqB$oxATwV`f+mhT9GXs_R;PljjIs$&;bZNtIzgq z^v!?-rSFmfW}|-z>^883cKVmZhslVt)4xP^83h9?{Y&FRWI|Z!UlJZmeYa9EE%q;= z51l#3qRyPtIiYUIovIk~l5i4Y&p3kVg)x_iCl1amA(|4H{=d0#(8X#cYt=19f-jcg z`n%3Pg(h3-jRaEeFv^y4BY~6?SlQC81;A$!sAc2hP$_N1Tl--GTGelmM&puzW+PE5 z1sZ{aY&P13rGavYAkJ1km8>>sVx6%~EFPK-ItC~m8gSZd(N2gEFp=-%+x|SqNr#4rxM8fuOJ^AxjV87cya~f4beYhLw?PirR~@?_B+=+Ym37`svW-`Yl6VWX znUGFfBXEr>%H=FWl!@yZN^+JV@1Q6V(N&01b8$uLL`?M>qwA_4i>U$Q>RNT@@Yz5q zDbQ}zUvLG`X$Z1+hDoWSjV2CwhP5P%Iy6QL&&e9s&?ZYJ?_!XcyiVy;G4&ZRzc$L|a3;VW;`)hVPDIw5^GB5IQVeTqexKE=zg`m!pz`S5HR7jg}xqjH7tzzV` zBmFr!Y=nFhgbEUyYK0AxiU#Od8thpO* zM^cm|a_*#)v_tm>ec)-csb7|Jan)6uR(v^v6NVk=4#uOhnj7j817n5;!# zce_DJIE~ubcu4UX3&GA7goqFFVlPKSG^h2crKmRNAMFz&V3JAkoyNQ}iGc2%06mRv zyp^bxJHj7(v9MBKpKrD&o0et{Q?SzYyv6zk^C%Wr-44H@Nruh z22RnAZN@|@U~=53kd0!aQi(vwa@?-*tH5UAp68Yl0BKAI_G6(M(?_G*T`H|Iz6xu7 zM7hf=A1>EG=xC75k|R|EHY5#qBN1gQlX8iRf+Ola3F|z4m)YzMaG4QHCh&$tbJfI) zCE2!MUv9Lc-#G+<0I^ZyvYgJ2k*r9Vu+f}NBO%qX6!JG|>uNM3c}XX2n?QDWmkQb_ zrkp-qppj%uq8-VIL@<&O;&&+45R9uosgXvi`H1lYqiSl8VJXG>A!g!A*e+hn#7xx4G+ieG89 z1=)R1TMVKUZ1JY`My1C5QA?`1S{_IVfPgK{uKq`2VcPt*eJB^(V?!0HB61AMxKB;Eb;$VBG)oh8fvUfQog3)MsI!!= z%d*_zZYy1G<$=wmRUTO1Mr9eHH%w`S7y!F#p-hNg^<>3hUD@Q?>H;Q>#&;uW+J zlHC5Gd1s%HUfCf*>>dvLk^E+jj!JiBbd;EQlbbCd^f>h%-DMOKz;Bg^LZf#>nCa%C z2m31@>u3n}l;UdcfEQw6p&Zj`8cvFWnHxB)TAxN&OT}}b&8SI zHGVD;RxcTWj}2;x?i`?wqsRJKwSy=0sDydaE)uHGhDB1;U2spZ1u{A{>qr@ufycwx z_cG3TvAW8RZt+j*pS=oY+w)VQAU*$-WmOeLd;*CTTz9UBmAQF5hz$wGIUh^LZQS8m z8>70X;RKzCk%N*PGRjjP@^A3{)yWVy5*W~@Kx8NBbl~Z%h6=2XV9-!?q(Y9=vH%R{ z2%Kk-G1!#=zLIf_fX1rnrr7jn^`za*ZvsK?*=}wd_U>v^zwLRxx!Jq<<$AOIYtKUwqS7#UJXBV4Qa_r0P-GBVDx!&O6eeZvDw#c^e;N+y7VGZAI zZ!X^y?G;DJUd2;W`qi-MFd+_b%-`3wedi-d8|JAKNvUgtYqvW@hlT>Emw3+`v zvD3{>y}4S?#`nM5`*$t1x3|AO-(24;H*c=WZCXpJvbR0CKCAXl%Cv8dD*M~Lzn5QO z?;mG3zwE95?c(zK&HB9Dey<<4D^DbRbqnRMvUyYX7$@a#`58;>S=k}#Wp2iAuGS|v zRywut=H!=)v%kOHxXA@ca!X~(%Lm_l`z@$B-M{~^BVSrkhR#c?AnWPY;ri<8?BaF# z1I^#Czph(CPzr7tpcc@WeQ=BZAJ<@F=6WC z>rrMCzFMFBZT)&PuD;6p_qW%ZZCN2MHs@bef8A^UytlnPuRP&<+xEBOU(=dwM$Xdi z!>rp`#;AyvXxMM>jt)V=$)fCFf<;BVR=Jw6{Z=2gz0o{Fc|IXc8_io+2b#i*E`p@3m zs`p;hFO4@gO!Z1t{J7dqk5Ru8uj+AmI*)&|voGkk{3=^5{)9${_5nMxybkO`bX;bK z#igz{e}8*+y*X`{NWu84I`{q4a*F-#%5qt{hO`<^pcBYnMb8m>agZnWFhlJ1*+rgI zR-&a`oT@y{)mtGWFG?lORy9}2lgh|IEf=Snjw0ntW~AQ9=H+0UCzY9U`5JvB2ll&n z(aFdW(#p(VW|p#Zk&|#b1DY?Hk$fkcmxFDdRA$P}@0MbEuC)J;rtdBL=yoL8cYMZ| zxC<{AIGVG|m)9S*AJ6#}CvDR8sAcK$UqZa!_P?DQT$((s)&VO|gi+upu4+FYGq zzLPG)otI5wt&Q}P_ix@^RX*O~*~#_g_VU%uSM5sE_UqHiSh;Aq?LO=N`s$2~od@?1 z9^JeD&At0%0Nt-vXXtOeHyqt7hwDeLo~)ldIQ{nCe0RR{gchTZw{V3 z+HCG0oE)4yA$CqTSDTB|?d*bohy9q%`o$&CS*JyRW~lL%w>mzF5Dma##C#U!7dOY2vnDAKZWNZCxWs z1!@mQn%P2J90;jdXz+y8xV|KJbz z?*HN5{Rj81t~bA)ZTU^{JYJFCsW6L>enMGu#n!gT7M~bug_x2n?nO3>-jaRw%{`tM)t8_4{6m#gLYuvqcSiRmg8 z(kfmQ)8%UU(^0XKKx?{64~dA2V!oOV4y7i&l?Cr?PsU}M<0GM$4q?C>jK{_NCzQ{0 zM8wf5{=7t58GyFp&&BX~Ii5{di{)T>ynu;os@cuu^=5qzxb?H;V6rMEgQG<;s=rlr zFZDisaFt#FLwOo6R*U1|uvoy{IP8zJSFdiLZ8vYOZrS85vGy$D`Gv zn73WjTu8 zyt~~rit%BwSPl-4RyTLk61(7Aiate}OI?aE6kKt%Egj9rF9yqEH5pI;v>J~* zv*|u1vNoGei(y&A9SaoisLE+RpUqdp*{FyNbcjc6m%gCbX> zw{QQgsUy`+{NDY$dj}8i+}XRgcXN4udGT5a9DH+kuN3$ndk=nrSAy;O^wW{|1I;_A zz~Hm-e6d^&j+f7i>2f?ARK3)*!Eia7J1Nk9TUzY8ZN~t=w+pPyi^*VFj8+++MBitI z_Ks%r(qL2ZgCc~tpfk+ADCP^l71%d_f%!!-oJ~i4K96!|q{-yXIDHWwQb6C|t@!Bv zA1(`hxg$VxD#;iJhV!DT&Q{eJ8G55)Qb0ZI2JpMKR{t~%JE)=AL+Lx@Rw|<~m64lD zL(5k!ZZEW)O-Fq?+KOR$nE!la7qq{x&DcX4UngbUh0 zH2_=7!P7}$j`}9l!L(#IQwsor>e29daX84%6=Odcw(|4EfK+Of7%T@*2aEg?6Cfnh z9`qAb&s1;2x!qB_Q}?C!LH`%W{~9A=jF@K4V7!r!;V>|G$;a>&$m)sw<#zKTyc9T{ zJv=O?OIx*l3`i=@ew-GDV@}wN@B`Ts5{YWDEO@P!m||}&;<_?jECbM_(CA4HXQT16@yG9iKK>L0u!F2*4#Q*)<75(u2oz4aem0&I z)_Rj>7CDmu>%%aeWGXZ~JpI>VxJ<)LJUmqA3xgeo>ICAK>t60n zjP7|dSS(kQ*&uVSN(f=S=Ut2?w!>VDa>x45uQ;M?mpK*VnIX5Y?f~5!5cZj4!OufW zN`uSsVF^-#n$>_N0RHoTUyJT@2hJ8Te*mCSqz>Tb#7s0zUk}T+%HDHvYY*(xsua#@ov(?QJ{^}244@sBhjX- z^%Wez-wHosBDb`&6%UJ*G^RXy5T79u%`3= z-rxsu{od2h`#?_J`+IQK#$c`QY!4>lu&HdXyh=Lp?tWcj8DkUUVezz>d%r(%kFkN# zPt(ESc<36a8Od1x`A<*h{uiV;W#}{?FP6o8JpF$4r@~l;XZYp*3t1hh8R$ly9s@dK z=dnBp+T0}YT9gHVhNny?&sOu|SuroB!?I|Gv&r${G-~+(9}RO{+bve#7t>;1onUp0 zV(7GWj&)Q#t6b^ozD(RYA+I{icGv>}(sh>Mpo}FU+h~{5MKN#s`Kh&MMyc9H5Al<| znj`t!hRZWvuFCnI`-wmPgoDt(%@y)NyhJ{TQyGmWW(u*h*@^@yz`exQpD;HQDaiaI z&a)&J9jyQyFJ~*#^ZK>pJzVPdJD0-R$p>@CYb1f|jknZ-FWnjcPdgmf=smU0!aV)y zXs}qU4xbHH$J6E5@X03&ch9xGn>d+$Kc4nHS^Vdt@w`~92G&N&v6b*__@`o2XWH=q zjwaSw=<;{}IGc}F^-n0^xoG|6YVyA|pjjSS%L?yxW`#W@@Ud<%eDuo;>4^jQ5x*aM z&Xsr$0ag6*;%GAXDX@_qPcXOreEs&J1*-x0+71pbbt)8?ehUYtO#`*il>v&rC3#j5NYoJ@!pDqwH= zY;ZhTu6`WMi|4cBg;zVpqZW>}vXU&02E*8zao?vkNdq3on z4cExA*WuM~au^lu@R>1((2sXmJySiXxm{B$V)aepEfCXzt;av#gKcGuw9?}uALD)s zc&WtvEywXsId&5g51$wxc)l2{j*g#B#zT93!FVji%6c=HyLnGCM&@@ouWmik;xy6v zw(4MB9~HFCTFYFfOAa1)?{j4ZSlR6wje63(_YpMlntSdMI54lMnSbuQqQwG!>GO&o zcD?!cL(i*!c{CJNuN4eMn9X5|=+THGMWjJcM(hb2tFQSX?rMIpdzw1`{(Z!{$o&*R zk8k`S*obNvj@5=KM+a+`7#&CV{kjnKhSP3+8GG`n|5;k`I@B&b8KoE*7@lZpz6-Ou>{?5)X4)^z(R7O{hz>|!*b2!=B9i;%QdtZ|0T;W-Ropr?;$KnAKu9m`<(9SMX97T3RXQ!(zG|d|$MdSI_3N z!_{yweC`z#ebCFy>yPvCa#TrO#oW3r6Th&A zI-+u0z25U$J#E%!1KZ}?Y-omdynH%4o{p;9z4adcv!XgTcXSu97n5-7d+1$LS6TS7Algzw0oGpv&bkt*!b{ZuWtn74F%jd;v zS}cE@&5d?r9 zT?b=#O_x6YYOU=AYZv9Su6Tpzd7x!?zNKY<^Jx&>Djcj*;d8*q&O!MBxK)t?`{gs>2X%TBv-N$dX0JDOa5_GYuaS--j3`(ycj z;BVyy&}v)t65AEo6RL6o)a$CO(>ma3k=1`K`;g1le#!U>%6{`Qrb%n9N1j&K#cIVr zyv$~GYvso;^I6hb`^ifa;;n_h6`z*O{GQyWil_h#NDste9gtXj zp!ZGY2eR}Z<$fc}fT$s(@?P;d{zwl*g(#D`ygvK=?BezK;%4)@_Abq4^56+-^$H=* z+S^_DPyuUZf}iWGdJqtYAf-3g)q`y_!;G<4(w| z_DmF>3C^PS>Yq)W_9~&rnD%O-!;|)$2p1mhIT0==+H)WRBsBCMEcSEMV!9VtKly(6 zLD&x;y!7D9o{ub9%h~<3WGH8M(d3MaSJ^oY*{j|Ze(cp}vH;`NUVt|C>a4;Sdp@qb z4CcAGmEmo9z+ra%dVO*Bd%Y@GjVhOKuS}oULmB5ZiqFzPIo!GFlwLn>JG=WZmw|F9IFm2=Yqe|v8SU!6EGGxvAt4EwH3rdm6x?UAsClJV3f2D}iVf~dN zNrLrPh#2$LUlUS**B)zV1l;Pc{xDFhzxKnatijR`Mz99UKPF~1SObbMs==BN=A#A+ zLIQyrEdL1HDPHTzLz_lj1y=cldX7Y5QcgklQ4$47$#mZ!aYdC(SMmuPs${yBmgt~L zrW^JW1XRg%jVYl%mCUy@cy-qgfYV{4})puwVXidXs~1`sFdp=A(Z3j61D^KlICGhQ-JI@>r~|&)-$O zT6tV-bFn_ZdFNPv(l5U~tylhrfdkEQA3qn5k<`va>Qpks4>wnGN&PWpj4jffS#3Wj zt&c~R?SA$0wR$*K_8PEgljdrQXlapmC7KQeRff(Gg;K_@4quDf!ebz$k4hXuCDY}nV+|q~%s~lyo|AjHv-=5>71- zT=pR`41{x2u6npTF6Yf%9AQU-CRRwAJ8RnS= z;u+ORReko0&2@F8rH^k^U3iInqgLn>@{JP2&GBmzug!650yrCTb3E=^H?CL5y+W*- z*Xrw^$WzTa30wbeEBVlyqR2DPozi$SZzT$m%)Ip|i7fM6C(S4GTqlYm^V}wd9rGNg z`i^cnxO$gTx{gyK$vnSF^2c1S3DCw|*9n5fTn7pg#9R*wqQYGN2{OT4?}@;_T(`*} zUAVrJ0$RAP6QWnR9u#7bxobNyZOnB-5J$}2fboc7t^?u_!CVIfA-`Nd1i`&r4+LPm zTu%fLyIfBM!MR*#1Yx*bf5c?@xSojt>~VdPn9JjOC>g*V?5^a2bbzj?7aEcSbVSuK zNoHUi5?>wg%7Bvi@(@Y})Wr8Uxnn?8R00nx2DC+WaEW0+T~r5;1qQT5WpFTGKv~oV z58(y0MZIw7T)^iL{fEUO0-B;uWuk_Fp@WwgBP1j|Fc7dRs$m8I2pAC+GJ^U53!+ly zpn8B6gm98fU>Be5eWxa5M5vn;RaZ- zdqnHlURUo7q72XxHO;@UBq~(HWdVYs+Hl?qkQem>(O-a;s3i{K1h$)4OX|kHx3YTEKcNszJso)?+Y}3?{&jMKuW5 zvz|!rceA~GdwsGQUS4c(uGeSQ(F^hEgB|}T(gi-dIDN4`e`}q56`y?Y+QV)<`Np_R zQ-W3=!bPvQ7iCV*wy)m){`-dw-kXuaX&?%wUw^-cMW&NsKqs*}3h@7iUUyYRhejb*l%QrwRJ#V4f7nM9~UZ8x}Ho+OQr#9v$l_gK-fG^e6O~LObw!Y^fOE zlLGnoLn~b=P>X_PE*hRm?%^>R?4B;P54i_K=Y2nJ#u3Z>hTNVf7x8^)_zrv@Tk7+r z{q!H(scz=@p3ah_fgv3d=|;TE^KRTo_oqcj$m@ z97F^#nQk_uf<8INOl(Z2Vr##@*pzMx@$+XXkzh*`+=FO>Tn*W%QlO=UrnPODuOpM{ zLM=UeqF#qadT74hhT8#70FvX%%E27SSD! z=H`?YhspD$j-{F;Rfl|95GmS#40==(M5WXjw<>^2sOeo3#(sp+&}1Cd!N>7=Oe=35 z_Gb}0prafypCq+g=kVUnZ%0&0L5Y$iom;Ehpcl({VBHh%;!4*rA;-PeU6~^MbR7>P z_+k+Tq#hAN1d2U-lE}HNnc1K!B*ab=|}|L0@INQyhVbo zOj$FS|3vDRitK^j;xQ(CYnSbUN-eWP{V+47bc0uhFsT+V)vbgRh*W33Ivht_vHG4D z4X8;^d}SW4{3B))h*V%EBvaFuHeX_f>>474`v;{nj>5GsT2H@0CR_$&oxQ_oanAM_cD-vNQq28FS{Is&MC;#yV=I~cx!aX9hJ)+qaxR1KC{tn;nG`2fLbu1+L1H?K9LmylycB~% zc5(sZNqW>Gx3#Ot0~?$V4-|wXG2Tf#j9DayJt@p7LgsP>SaNXDJ*E@`@;J7v(huP| zj!pdK0?>_P&jidkwqu=7VPKZ*7+PN~<_oR97HtsKW{Wz=Dt8hRiL$z$PO-_EAFKLF zN|@p;VHfsbH@N2_2bE9K2RO(g@(cvCt6s=K9+PPzniBTF4$^Q(-5}$TU`N@2hmm0K zciU7i5#<;$p<68Cec*#oz%hufW7I)m9r!1J@SgxevzdoW;Mwd!y(axWPL!by< z!Ct?>>2X5gUcaPALQ1&TFEYEoK(yDd$xcLw_WC7RG{PQgy?)_Ni92eIcXV}qSuPdc zTmNJIj?HQKWCqV-#PmhXTjYdA&Qxqve^vL03gOx}06c3M`{?^PpD_WE8Y-m zB}zgn`N~N|OeC9+Y|WEfXW5uwx{KR=CXxMSjM>w}zH`Ao6F+spp$lblaGpE1AfcY4ZUr5cmqJW{GH6&TBy z(dfP>520#H1;#QaIyz4lTa|{}Y}MVaTlAQM)EH3XsA}&DT;tDO`oa#1fL9!{L)MA`vEK1iO4fSdl91n9PGp>f@_!LeZcd zU#%-fA}bh*Y$PTd5+f;lhFGKt&A01>PV5d1YCa;L1<0St?xgb%(B%S93fZKIO)KD0 zWN--q9KcbtV0?_T`?VDIN0b=R@5?y7Y#@nw4Kty{vc_5WDcbsHQHe!$G{MB68fNi{ z>kxX|$2&;)2{DONU=ESE3l53IDKO#@w_z@fxC+R}5bM|s8ZilG-zjuyOb&4qmc<}u z5!n!85tj`j7I8pN5o5dH3>Gm7&Oi~9V4p->k5W|TpA2HaAQofn$Hx$}#fvQdFo^d# z#Pz`5gFp6J>_rorVYlbP5>-;iU6h3fk0_g@t0orikt^nj(Ut zGP_CxahTog(L!Fj5;Yyt72$h77M{`*5Q$ir$!=1OP?B^>1mYse{v%~P()9qBv ztVUmo@)%=#VplEXD)JtS02Im8+JYoprQKogX50#SaF&BJVK;8I$v%0t@~uUQ}p;+}9LRAd||SG=xtn$Qg-D5SuwHxy_%Q^-NcnJ*}`VL7iSkYFq>jkAcn*ArL-R*@ynBJ$o( zU=iK}3T+r}srvGqh~jElR5|zY1avFTeLR7N@9=nnEtU0@0u4765Dpi`_jytQL}$IM zK*O_MR-oZIFDsB>B@WKnli;j(6==9FFOUEY=k>!QSgXj~#}!1>4(}`2QoFpi;E45o ze8CXOeTP9r^?Zr}OJqOFAme&G%%Ed?KF@$9`ajfQ3WcWh;|I1>XiS|wFok+Q=wQi2 zhV<_tkz$8#4tR=KH;mk*-jw=Z~1#_Ja%D*pit6{%+3(Z*@` z0)~t;74-=lV^zf7PvtR&l1>M%koYfQ=vbzVk9_Ns-p*?nU13iH97;oAx^iD-8)>%@i|JRDxE*6?N5%Gn1%eJ-c3^ zNf@LjVWm+H^G=lWx!0$rQE+`TU(!qx$+|gk6AjX_O;?ASy*RfD+jgtg?ZugP>)6Kb zUoWgDL7GnEq`IxLI(xPG?QDCqy?u*I+`7AW>sFhFdI&%%a|xy_9tcpXG@dCor&yFi z8O{XJBLZYW-}$ADd~HpetA+?ieSE6(0pBFSHneDDuJdnlEH={GsP}FOHf(BWxDR=~16kU{cTqo71XLw~WI-iNbpAWRsLyw+p{wM2Z zw()0bWHSurX0nrZjk1}3Xta~gGMbxLD$fk3R~D3sIz|cSc4|zPS77-7LuAJ2#mK1# zs0M#)chd#uxQ>sQfNE_#QcP%kOS2XL<*ZrxMu7`K#}tF-2i7`S#~`BV z2X>W;XFlQeBcrvTGR1iN&_*YLm0JM6tz1cnHDXMV21~_2Ff!$KR-Sy8VXr@nbb2Jv z-+Y#Fw_gmE`XsSK0+D$^z|JvGRl+LBIB8jRvD1i*bLMT1aiS5HyTZ_B6+PFA5|MP+ zoFte|lz>I(&PfRBMhSKYe{+&(r1RQ90)}~`aiGlyXG^%@!0wn-qn($O0N3uAq_7eu z&FHxO(`4$IiS1mbOg&7DlYRTA#`SZP+xf?F{Wv*$t;m)R`)GHO##IP==m3PC)n|J) z`es0a(s#)Kv(diF+>0ctdjDmrc{-yCDG9j$=FA0yOzFVo77W&>*vCh~g77xt^9RrjOjk;wDWMRvaFle)ZF+teM8$7hx z!pnHjP&hE!XeUGnn8#_uhtlY?wi>^K5r2Ip+K2yOGz1 z1sEG!qeAKs7XHw6j1u;ad%+`KeU8sLC+GScnsd&}QLrr3O#-- zlYmksELxoBwV~L;X`xmXsZ=1X7V2wBWsKu%p%o&ctB&0dl4$gy$~tc**~TkHNxX&H zOh~7#5x7Pb<#LuG%Ea{yB{|EGcTkjw=qkjhxws;ABBpwc(RJ02#ngatb*;K{_-vq* z6lgc9U7yB=VXm*Xp<$AcQHszUZ?b_nEDKu-y7u) zXz3i9)A1B(H3NzH_1XiIg?(Ga{WZI_!4fF}5U^!IiYjxKo7cwaQV0$wN*U9D?K2oh zU)9A|+_~bDG~xoRqY6?rQN!5ffzrBi3-&Os%Tx&DOTvha3^6fgrlY$l)h0@dH>fwP zP)2GM|Dy{LTiyEbN=TdVK0Xt$RNb_VT1WYDMsdkDreJbLf~|yB7I-=Y6htgqfBI6ivGr*)ABMrDNFj7i6M%<6jq_hzUx5Gx56sUa_?#`%uYd)1T z*mqc2$N@v%twSzhC_BgDln`h{nHPDuFn1L!+^12VLQv;PU|z5pDx^)gTt95kRxxte zk^Y<ik`tv&@v?ei=Htm3WjtGxoC_^ zP+Xh!AdJ|usgY+qVGHxE*D87D&DC*V15A%>bfYn8G8D2*2c=?aWEuC%#8S|vE#M=z z3#CD~Vk01p{>4xL!<-~L8Uq~@L;Y3AdbGMQUokT&LVxU$POFufh~Po?NQi3o_(guD z^woO)rX7-Es-Pt>ilkBhI~mYQJ*1@3PE8fC8el^vjg;hRdR&`KJYnW;z4CR)P>1bCXS{>msu@xnWR}tO%3pW{3OxB{W zyWOB9oJQ?zJf!%HgFv+C&PGeq~L_qgWfSyJ- z-b&QU9pR6?SXimA&o|qXP0fR)k@}^i`ZXyY;-OM#vgt7MmL{4)wILG4E|}kSuYA%Z ztA%>Ho|%%Zi_%-(G(?Fk8__!?$ z1E*-mHe(_cFgb2i$VRbIsYD=TId0eZRbaDl&vQ!&fHbB9`>{}s>7&u@E|pdpUxl?k zqTJ<`50`5obTr6j$&so78?SxoYCY zl5AVBFE`rJ?;L_afY_*USx#riNLD0F*l5nCk&xu@D7T2V)^ zRE-fKaUC8+2389P)F+V~4?9kNEK5XuKwm5nk{>ycv!y6Tcu41nFWP$opLda`1$u55B`bpew`<9@MtsvLCH0vSMF$#yh0~4CTa!pnZ-ReX5GAw z=1Zv>Vc!q)rIaCheT&TTQntlZ87;H0dr>4T-FKpL-8Ci>n(il2?X?Q3PAikY^)(?9 zNpAnpyt7Y8uk4T@b`OXBNPe?MN2R+mI!a9J-Bnaui@Lyjw75IP-K|h49^BpC-QC@t z;_mM56xZU#9SX%gxLo#LYwf+xKIe>k?ily6FUf0?kz~%9{J-zlIXZ!f?2+jad&U9_ zv(+LYlsD5s{N2fMCeWMMMK_RA+*U6R+b%L-V0L4^{hWw*R&Nyi=R5?eByO5U>wIq| zVud=Awqywgp^VGnc?sot8VQ%w=D?5D`jeU~BJLMWV^v1Q1iN@+R0?u&{mX=H);NN@ z;_dw95^Z4|kr?fMJ;iQr0t8Z{=4ED++ouKV&_SfYx-Ta9!?bX&rGy$D(f)HI2#09N!t_p3OL`P#GTI+jbTSBPQCEdlj<2X zoGfOO4NM7}QaJ}lj&S)>pes_MdWJtV3ArN54bK>QSFZG;c_{U9n`6PuoA#4XA2GC2 zE`i}>r8^f!jrHv6pLpW@>QvJ<7Hzqw1WxG$*PlL=$;D;+j@6e(kns8sz*cjq4vejF z6AXkv>}JN2?|weJsEn3hpR)^)85jYGBjW5)BR#O+zaANdeT0EOP$a5PaN@jhQW1ny z5oIzf{_N1T{OaJYLy-Hvr{4D!XwdX{dgI~jV(;Tpr%qney|(%?%$RXJv9Wx+b5-oa zhxdT&$|;WCb+`HYtxNNt-7K9=QvPa-?MCG|Y=f)97eeLy7D8<|Kp7bx!@= z0fKm$g7)c4&DmmH^l`5^29H-qSDTk&V~UqM>eCzW+ex_Zo4so2X-?LeZ%fPD^>W4P zo@8mu`PzC1aP<(_^?%F2+vY`YC&#@LpPOm=S>Q@0;Nc^(Y;2BB*FAXj-a5K`7Zp4` zpN_95fD;ba`{ip?&4o0cs|m*q7I(!`PYb2>-_|{^|CTy~5xnZSe(^NL@?6zrsIk2r zb3~~b%q$)_d%&5QSr1t$WrDiZSh9%F~z{a_nt@Ya8=3`2(JZ>xF)5h`iv>KgZ z5J%IZMA7YaanOq<7y10y=xA`4gLfak9M4!qCHSidxP6qi|L4esdiuWYlJ2536O}^? zyxg4ScivXvx7Z9s=9}B2e4T6BQ~$}{KSnN^x*uNuoVbAMaJ4;0W~Xe}vts{dQ#}s< zkJoQ}`B+zP=#8|&l&h_iYEe=$$IDTkp)aj#X#Vl1?eSuUJ&d8a?spvdgUB-`rN6nKoB%ypJaw zH6%BL94(nx0PjKyJh?a_pZHW?-~TCEaT+RVu@`x!u|Gb`mOnA3Joaj8o+{O}HUG5; z1gamVSlMoBG*$U}c~sE7e*U%YR`2WV?cUVZP5s2NuhoUf_qI4!5aqN;|Ezdx=<2*b@0?ra z)798VH{3{haSh|-t?=lt`@nz5%nrZDeu>_ykurE@aY zw5jSVRl}%a*0-u5!K|6b(0vodyO64jMY^)nH{Mp?i%`$IH;^Y*4T;(S3jcbBOkDLE z2pw(P*H;%udj*79(Q&9LM^oIA_2MbddzdHVwGLt&8@tbM8w~X+=1Fq`+;D48yE^I$ zo-OAmFP=Q!Qu6Z&m)t(F1BjG+o6qnr-YjnCv4wn{MMddzea&h-6_6$EgMht32PWO> z-B+6ZuiOcwDNiOsYw>Nv{ zH<-Oor#T!NgE=W;w1GMb&u!QQjKd9w7Ik=Zu~j4AyH{u~r?7t+7}YCc&V4Lv7few@34*4c1-F%$ZmPmkxED44+sszsHDH2s8UK z6JSQpA7*u&GPZ8MEH2vB9BB^DBr(vz-c>Cu7wRR+vZsY~K*r9`eY!3)n(dRFqZ$ew zH2A{7t+Bq=)=|=Tc7`#x|8ZmO5HoW`bR*7dr3wy?K zFA&(Sh1uT5U4>M##-KWPCbrxV87b4OXhi*X+-${E6soaonK}Q@)<4+hpRNCw@mb6N zwe`<@Yx(c3e?92GTmMAw!oRov&!qou{Xf9}+4|pwH2=~1vjG2JTK_xalRsO3INbkB z>;D7nZ>_)Xt^eOzf7KwCzgquA1Hb>d_0Opu@OveM_8ukWZ!k8E0`GU1S2nG%h=T8u zXQs|2Z~^aJ?CCf&#deVsYzUpjs;pEJ(WfD0Px?S!p|NIVz^dh40$1wGM<_K8raf67 z)#!usS<%zPy{*ixSj8s$wUD>Q!tyFT>D+<(kn!6oebnb4(%6?NG<2I)_MZL8rWFnD9pU;@V{!0D#qebVwu1i&|#+MQx7L(S`x5#_t<|J;@`1>rQtSL|Q*;a{=8U++I-|D_LqkNp!(+Y9hRfQMM8|JnLq z;Jml~@Qrovt-rvRf3*JJ4BuP-KyRWyTYsjof3*IQDE|L!{X4_v|JC|eqW;zT7sLF! z^}nF}tMylk_@niIp!qMYKZps;e{21F82)Vi5r_WS`VYr2|JC|~Pz3Uc5Ct>3kC=T9 zsw58|I;5=zLERO7h*&Y{-l!ftb?*+YiBAH^N~}mnS<83n zx{!s`ZUKg$-`n#k(_vBXdI@Akw`-p-gi=_0CN9n5U|3)jQ2l%N!gU^xbM;Jkp{X9h zV~yN#jhRR~=n2`)IONa>;nFET=I9_Sdr85^d)+i#y!Xu1y$5_?oTp%MB-wZ>=-;nD zGnKK9DmQ&Uc)^0iKlR8DRgVg~VF{0k)lh^hL=N zgLSwxZQK{<*tg4vuB1L~bm&_%#;BA_3q3^2hfoh=N5IBaq@&jMTS=GhqIU*-=ivML z9S3cM`S=n}Txk!Fl~zf1yg~d0r;W{z&qURmo{#Q?BW0exNRunrmB6gi-k{x2NvBDw z;b*JsHIlh}RtDU3*_e*!ca&5_pP3%bIXUor-P( zHfvs$uq!U2q?de&EBdj))<@l!?x{mN)xIwvVxM|dN3zUWJNKb+?Vs@-h5&_pF3HbiTQChDyHp{8CWkdeA#_ zTV{sXaC_gf&$atz9=eO$RkEO-TEd5q@P4e?ZsO)2U~ii@CUW`Gk;`}K^_^m?ZJ6$X+UtLmFp^kCBm)^Sox zKzi3?CDYj1aC`5?3?n1iE8}z6W-QOI_frJ5v$iTKUWLTg zH|mKRWY_vNdH22quLA~#ruEYQS7h(e!Tq5TcjF=!{MXhbpb3-fb+%E|_j5a)b&^yr z>BjCV&eTOwNb80LmXyP7EdX-)U(;g86Dng}a~K z2a!59o}co5&41&@jVND)4I%ly&m??fCKOLHOGHIFPPkLO57kjpc747nS{eBc zG~C<|Aq7O2hHR@@r#d**nuO2TJ8jm$$s^&Nyh8|g$p3&4WGVj!A#57`ZxF)kUl2kS z^gkhl7V`gq5L|-)fDks@|AY|U=SltzAxx?LuMol_!`~r<^#2MWSoi-6LQv)WFAzek z$6pY_hp@jO1jdj*AOvree?bVM2LFT*f|33MLVykUuMmRRz`r1bYtsLO5VQjR7YHGT zXY?-!p{Do`2*I}cPY9uw{GSlQFP%Ri1Oc#rLkKzKSARkXNI1*?BZMF*_BRNj@PC95 zrkMUG2tnNH9}t4`_kThNx+4EK2*FbJZxDhz)&C437?%GVLNG1=uMom%`5zF%VC5eW zf~?hlgAlOV{{uoe*7*ZMaIgJO2*H@{4+vo_{ofD*Qs#e$5XQ~^gb>_A{tJX~%Jv@+ zLaOFJA%xJazd;DUcK?JBPVoK(A;_El2_aq!fyuQH-qq-LHNxe{ALh- zGYG#Kg#W)8gf~9V^Od!Q=$}a6Hp^cSy&4tC%_SYkmSaw>jE{YV2$nPD3i~3_Wb-)( z!x|^>(-g$U&`d3E8~B19dk?wn%q$l#V|2p#UBRJJL<(l^^<7`fwGw4c74~T=*JeICMYEdoYKqBo;6sSHfz^j=g9RJz;v@OPejyB2@t;tWR5F* z1A|6Zrw}+0y-=5ufq5L5?NBzPvWxJrX`>JT!x%M8+wnS+M7umMgS_oiS7#%>p=KG?>c`-hH>KLZvF^P zu*_F?89pHyPsmoOQOJ*O!TFsQ273V(mU_A-&AqxGAwa>13jD@d67dD>Odscq?e98bA?lIl3P5(Gbg ziHPc(piyuArS%h$wigfT z!fZj%)<&@e(DE3XTnDm>yQf70vtQprF$fQH7>Ax}v;n@e{WPZ=aB2K0p zewK>dj1CV65lz39U5avUBZp>|71@QJqT+^uTjP7~yomnygQw!8zP?^PvsiT_6jj5l zFxP~9K27+oVD}3;yyD~Drl=0?$GO=GQb2NSpt`;8JW4rh7c5uNp)nJ+^iU*OcO&ocV=1(i>(H=g+hryU2JBQFmrxg$S&&Ow(zH)wE!9UVbCjX?1j*fEbKfe>K|eq z$nq#3G4liV18{mVbGM7kiH+k#;E@DhiU!>C>LLVM>{3?hQ~@hAJ~U#`yE*xV^~KPl zM0p__0!tll&iFY^7@cs$^i2xgB38z+ zq7kX(ddGU|_@TJTy(7J5b3>~GBw|?f?edys+$W=|e(=hpF4J_Q+|{(h*ONB z5CRjVW@e8dm$aKWBZ2c1PY*|dDoOypZyp_5&mQdTlJJQUf zH#Y+eQd6Bj>d~_$t9B!@_8)F;UFy7cH56Y$vdozw!KH1Q{aJw$b;BJOzV1gL0N0lB zzF)t7!i@ErsWqu5iOfHGnKmqG{n9?fusW`FW{{t}DcfVN6gDSxFzlX3jl*dm}GMLfg}+OuDkw)cT+q_NI}{4#&7 zgMi`ljZeD0gxvc5nM4-dnNku}R}uHIA=*m3A3>r>F=S(> z9hG0@nzWepBZI>}Z&lu=*f0i66Z5Sk!w|XEnnhIh+aKpyb$J6`T zKOO!l#aKTH{%w>i1F5CW+qJt@W4+Q=$Cf~;x(TS-pp|+(3$|)w>d^sW`D=7$bhp1i zG*na%bbT}naG{B`nkCqxH5E&stIgwee_?lf@cuy(MT*rSfSVl|8vgLC~?BKLmOkb?C|LjsQqd#EXL$Wa8g-g6EUexmvTKHQ=hRyRb7$AS9MJ< z-p#yWWwW^H1yqi|+FEz|;+?QqU3*QSwcbg4y`Y)o_ze9<+c9|nWf8%SvaLjhcYVoMFf zoL(6=gQ78y^W6)EJNt_WOhQ~uY2GQ?ofqvJMSZ&57+RCn_z9H*-z2uix}_UQk%^#JnIZ4 zGh=c2YfGdl(;~Y@9Fs%q*R1_5EHC&h;k4dqx5LZ#^TO%!WVUV`L;`@AS^Wjs zNovZ@7z!Pgb7$?eb-2D?1+oJb83|7J66Gba(af#0gu|$+5G>k{hAY`o9f3ZdaVd94 z#pp8o+pKL=t`D0)miVwKyXa2Iu?iX$Zlh}hR{9&~@MG)4E5th3Q=RJNIlY#xOA4%-edWA+ykBWHHMSVUO!Q~uYtP8YNx_Z|oL z<31b}$NcOOSzXP|cHJ|?=mx@DpN)q(@Y!^}b3BkX0bSHAfkF2q0SL%5m!q!?A?qol z91|YvudeDXhT%XgadPuOA3p026dN(W*5t~pkp5mKOC(NnG5%<4>TwQP(So0C)I)-u zV_n9d!PDfnWbPl&QXHaw5<^!N1TKvBzq~ByTRJ*=H+c0!%Mjo<;`M%OiP?;B%>!QE z9Q8f&1Fx!xE-Jb3q8p4@eBy71*Im9^mNgXe5Wq*H=57?DS~gij_h2PMQujBeM9s-y z&X7Nov{0QJFgbyZ`xBZ8Tt2!6Eu|dV8BKw`yaUHRiOoe-WrRV-Da#_K zfFh^w3S*{VOHm(h62r&OkKs(Wp3q?xyBnLR<6ISgj89mdc|P9XPvxv%kH3`uPM;R!9OlKr z+XFNg+n&qQC;N7o(-H`aYK-?hEsN2Q=cf>XUuY{vB@#{1o8H8a?qQ@rK>ISoao7R` z2oiRnXAsZvzO!^Iya8tMzGq}s(hk*TU#|fro(o;R7*21R$e^s^wENs@-`!iWV|&P0 zW3F?YJv!RA#hNEL)^dY|B|U zNhZiuumYC11n%q{2FfW`d1!uaU`gRIK+#Io~TfXG7gq={%tobl{DzWX>eO%()>*R9_T_*2F5j%8n;iVmUuIsJ}EHjZ!OjsylU{Z6%Lm zddLb)BqC}z=`h8ywW#$9Qf2z%`?uGxIJB&oLI8LLpK^ziUP@n-L4=i}wy@F*H#phphS&=e6P?j zbMw`VXQfKa9V!pb35MgdRNw&1Q=Wq8Kh=t7rDmI+9>g_ISt-q97OFmajl6hcdsK^R zt-$>Fx)MQFzjPXdELEs0PFsQKKEV*f9Q-D$`K|b2L6Xi?a&}x=HMq&J&V{opB>83}@R3PLxd+vk0WMz}}YYF|dmX>4gum-yPRTi&ji{;X6^|+>GHT&P1wdOT;m~!>YP$f){CsC09%I*qzNxjcFjtAV)lvb zk{72`(OO&q<3?-xn5Km6y<#UHT?%e4;oLK-WdH&hzn3TsVk2|#2i1LJ-$X=7p3TL{ z??joc`NTSh8+fqX)v4U;_WQScjP6$DpgCnU0cMNXVNO+mGF>hTZ~$Wy4a zo&r2lLC|M+tyB4a7hj?DSO|>xuU86oNu`crBP9XXKNHe+AzA&+qg4+eb=#R=`7rTR zud*!am`Z9GzRpl_@k!Q;`>rWlU2TkTJ64@h+VK7}DmUc0aPw^J{c^*~z6GmiuSvn1>G<&?LoDz7m+M5+zbH4o8RZaQY z@C*8OI3`e&Vp}#X6*3-6HxZE_=Ie=p!^&~9^IO1`M3f59ftmgI%sg?-7Nw@TOU6)Y zW~bSLg-!s{xh_3Jl5I3t^)y3E9i`C9H9Dlrc#{Jnn%j`@BN*igE$j)Oqpo}}xXuJwY$^z;7meNXK{rve<{2a8K{0bt<(%ES zW}(=dkzT4LAbWEP?g*$6`&qR6G=3m{=Lxykg-GKI%mF@=qLh{OT8DmduKXRNd_ZD# z6(nRkR+nUP&OmBj{XCb+PFm{DfvIhbc?r{UY1Ylt%0BIdP})xo@zB#oKAG&2q@O2N z92`?C;!nZzau?*EnyUHWJ9h2MTho3(%?Rw&UlM&RE)buZb?uY1C|}c0Pt?Unhtt(d zKw1`A9<-ZIYn)&RKx#HOh}ezKO}+AFmmd3>UmyxUy|~3nY!Za&$t6=Iv8jE}G}u$J z|KkjHQN*W98uz8Ycf5LTd9s&~DeEB6_6n9ooNJk>ORT-0!~G(jLwje-nDd9tcu-Dq z0(v}`3gcvF{oE|y$G9q93Ch!Hiru;1!p%|JJ51AiQ*#1#j=D!_-&uz4DE&t*o{9+tL1Y5WqLWB#r$$7D^UP?hKXsJNz9cNa|c z;4Ep<)&45XJ;R!3^A+e+BuGlN7rtZAzVZ3d*pRA2cDr8rx56wsIoi{_4XQR2 zjQ!Z>h*xemmPA=6$pmOwa7)c?ifs6|!dg7FW36O={k?4aMk32Bup`S5ik^oXGuR&$2js|&`xW3;;5*mZ4-&u!jMzg;1G z9ijM_ITuln;WJ_O*ie=t^S+OB_8Nnp^ObmqnZtDydeYAFw!;^QJ5~>4s#Y0%*IZTN>0l2pr{?8< zE^h>7{v2!gB!A~w8E+nvmHm<6lUU1`;2Nr8-J;B;SVvq-)_r8N!;g5#-xgsduBY+%!victYP+bAGkyWn?u+k_?m}4+4ZOusQP_w9-<3mY_`(! z!1>N%@7QaJwZ){?mBxVe4NIrZOS!GBL)lsfZj8f3;h7jA@w%!crr~j~t)UBnv;b7| z79Zx_BKF*l{t*Llg*wHzrsje?$4VVLF4&ym-5Ni9CWf`#fXrdj2 za2qPDO$yoSM)D_WM4DB=`z7u`6TXyrD2_C$SkJo8Xyh zGBbuDm>=(_ND(%(07_G5Ur#wf3J4AZ9tUDlPQ(y@5d1xRXdG$n99&B|mR@)&z_Mu9|-|SWa_{d%%)UUM^YGu4$SwdfilgB{XM_u@-=ecf4Go?vCy_qTo1fALGO9 zr)XNROw)8_RGDmZ4QfBP;`pMTjWiQXsFqKsG%<#z>56!DldO5jpR>$a!quD>;Hi~n zyAha8H4uZlS5*CW^8*Kr_&FMWYW1IHaM%`m3PCwGM9?Qupy!{L_I#cPG5$1BVUbU< z8)ukb_`GcbRD~*@&T7*h6fyt6ZQ`^FUE!zKgH&6zWQ{tPXmH0ZH6Fgkz)WA{HIE7& zBp{-|%TMzR&sGeoCL%1~HtF+4caNA}+N$8WPjcjQc^EJ0>PTQKj!X2g<)`oIARHM+ z`)aM0!1nA=Pe}dwN_AZ?5(YLJ)aHAes{33vNa86v$B6z6^=vAb(eGEH@*^zcPCNHT z$%hbmBXkYny)o(`iuR(5^wkSRi5m6_Vl3k}`S*s!^JKZvX~hZ9bSAiRBmt@BfN(ke z;ukW5fV2fPkT;eI3dqC0#w_gIU~^9K1B_xwa{aip?kuL2RP!J)4ugHrs9tXhm|-Bh#u_AG1}Wy@Vq03p%p|>bX}4h!dxjbmuzIoP2|@PmQgGy8 zcA}qEcl?|nbXXWT#A12`LqZ~qC@KXD7a==Y{KIcLp(QA4<6l+nhaps0py||@{WIX9 z(3qw4DEoW+z|dMp^_cX!Axv0s>7W_?Gos+Yvm|T3guPDJhC#@%6qDqIKmaIHSfY^g zYW@5n%8al@KtNywM*QIYAE8l4a-;l@PzsrLi9otZ!*bvE|L4aLg}^JrXOK+K^_l~Y zpo>F}JP3*q>OMzKEiq2kDqGeq)>g&+)R zq8yCg$4%=(FtA9#hhgc53J!&ZZIaZ&B+Ese-Umg&g!PihC3K7W(Sm)E=Rj?Z=n-z; zxY6bz)+XHR@el|B1YsSA*CxPQ`Q^mvBj1?v6fK;4c{{eWr?=Q9A5U1cPYW=LEkemW z=P01L)n#^N>TH_F*A$K?uw$MK&54c~<3crF$vJtf(`!p(9WT0mdwbnpoj9_Yd|2rU zT-dN`xA%79*>n^fu2{3BVgC-;emI)!rnXRiy)}a*d+0x1D^cvx?feuwyd7Y(KCCuqfNKq|Mg z1~@-Kwj~qXalY6zUY;oV3RsP332gt}z0jKP*OGBc2Zi1V$T`w@Pdgb17ul>8h&IuY zm}5S=A)?3=LAt4Yxb3H&8~O`xr*b}q71`@1{40^_bKc|uMtEMaLY+&S>SO2r%^V8q zHgmBu89pzSV+0tHtIg_Q5@q^JD1KsxZ)r}K)g7`*BWck{Uz<=bP-P$&^H^q7xhOm|vfSXm4Gk%^K@r1*6>lKa6;4eukwVRNFPFbkhRzz3zFyWP z^4AYhuLV*iNFj2TdF2n0TU%DJW`trYmsof`igbw~T#7#dX|zS z@U@OEVw#}WuD@NokvG!pNYest0XWWfteC@v*s0vQM;c@Cg%OEUa6+&$M36k?QUOYI zL-ewK=vJPp#d)!E6u1+C+zuSPlVu0tfdaYq(+!(+Gq@+`I>eB(7e7>RRT6(Kh~RyRvx4PtzHIr5Gk@oKZ(gr zNNjtZ(!zDcz(+OK!B^vvFOqBVVL)yDjj9w@5chqNog3pz3lM@Rp~?;r#LL*QZ-0E7?)u%1_3}R+rWmH-kr8ZUgvm?U#KIwlv>GiOW4aPJ2ERNO# zNJOC|s_n3V_!8zwA{^8lgrEnd-`-nIwCiUSs1Aw*KDyv~T&hDhj+`H0lNS{WN{9{v z??3AtMMBN-;T4AeUKT{aIUP!SYi22Mjq-(gB#>ge#E*m(=A*ZNo_)YTbax>D5Y;+^ zRd&S4zj9!i4@X=W-Ax7?T??vNz_?a!7g*I8W24GGsqDt_vU&r)GPgAm)fq{=idAo$ z_Yt#QaV8J9Wo@CFugLVur@4VG8B>PDwA;(`c>9%KBK#0a0d|eI*8RhhSNmLob)Y34 z53*OK-X17#NN8yOw=ery$|szsXE_@zA2V{A zdd)0@22G%lFVNmny*ZBsA>Y0)4Sf(!?=O|qZkOP&I7jcA8N-BlHE00@8#!xP<4Z6S~MpYvzjKq6ikII;|AIzjU zUP#rdl=?c@Tl7eN_gbf5PGI>Q_F~;|Kn+f-ybLi+Ty&%as*l2jTkW|+q~u)gR~r_M zSd$P^1v}?#HGf*I$+{GP&Xg-rYA$3|4z*orZc!?YXV|ktVpr=Au2CVlfeleS1;(FJ zF0BbraR8s`MGcth-AZ8XCzYCocY1)(6RvNBS%UiVV|Wo5k{{&a#WTT-D&NmPB0^Lz zWB_3uON6Np=m-7~q+9?5;t`^pgB_UWa~-yVA89~S1)I$UHDef1)!V@UpnLQ?^u9zj zylOz-LZu?-Z>FGhRq~_mq7(<9&Y_g7my{0Wgh)t*6u?T+!S_>n?T|oj+}44?@R3Rx zJ7UNa>F*r{^&0P|5ct3QW_T{v{fpyk4OY(hG>9{5jQOL zCyW<7bF)lL56Op76uAMSWf2kv6>70-S$G4`z|_jRJ0!uVOf32Peu3_2K`puy1mv(_ zs}X5e0%hFCh}2aLFz*AE)R@&iLwdFz%%iOcaKdEje7!Jv5i&&P(b>GP3|n%V?vW}X zn1Ewx8YI`%=Vo&u?q;YA$WU#*T0m4j zs|PAruYf%U6?vd4n#0vTsWpYaD-9WRZo)JZvP|o@VEzoR+FT_Zg9M{RrgSoJ0po>0 zk)Zxc*I3-2MdI?gg6U-UC!&ERjnHDmxZjPs%93-*@+5_VA|ZaoBJZL+f=l6vX4Ljs zG?oz&7^)F`QHI;0F^Gl)LGNAA02d$V#Kp~*DViGR@Den~?vLaKQzO>Ef8Vs}7r-5S z+a3jrJyI;d!9+A`l^!!l_-dw z!9uT_nE$!xfGfI}!950K4mL0ZOiC1<8QI|o4pv#?`!NiWIz>sJyvW)y43(fs9(@eU z&W0>M&H^~Bayqx-!`_##!OQt_d*6rA3N`KbcVU>kBZtwP%1cYo_1edXdbcGWq_dTf z>kD*L{0`+AX?t!`Q!w~hNU`3%XonviuuNGkDRLlE!@K`WZ z0}*kh#gN~4lc>ldyt72+PUfNFw+ga-rw{f@h~SS(O^NL$7mx&l%vwC@`pDK^fnh}U zTGq>9_0+q^A1Sfrhq-wG*UfG|0wosD*umnZ5}y`tncj0Sl>vJ*IOuTx5S+Rxb+HGl zNc27>w4BC^@FX}Gk${Y9Ewl+SKw0l!#2&DUN9pIoeBaZv66;l5(LfqWP@ z>NuP3HNSv_PcLD)g8n#2o1as%gBKj0Lh2!QlEUQ1V2~`>?Oxb&i7S$Y>jT$MnJilU zOx6@97n=1Gsy0avJNn9`uJLNDK$HGXXcXu+lINxDBb}E7=v5^h{eg;;r(ze=Zn0M; zjNX>4RWU<_T_~KFw4LluI(~3=D1||zwHZ~S6q#r?ftwoqVQfbD7hpmq`%92>+rvro zl~S9q4fWlxqFXYtGS=#=Rhs1;;B(8MN5jVIAbJN>)%tol{4Fww;ShRQ8aHx}nm(@q zU4a^QprmNfEGbw|o~@VpyVJD0b4A{#cRuOHGr%rxgpiD5yNYctV+uPoea2Wf01Wz+?wlvj`MW zfCbF;jVw8z(iula>YXr)M{xpb=QT4yU6bz_#1i?ZdLWZ$%1LU*6Zl{PfJcKKG?HRX zrm*3ohu>FzGH3R#Wcu(6RI*c5HY-2ap&i#KvZ63lFWpvP0Mh){tl}OKJ>`tVaWPAr z+a#=9)w>!HTouJX5;HY_Wox2FKfMVQusov5t8)&%5v%nz_7A6Wz_zbc5Nvb zFhHmOkWV1=`BL*ZgTWy>(rQR${R48^mDEr^PQNmNAvBP>X!`}a25J1|kQ(_@SNV50 z6i~)RFCd^gY_e~FT|@E?n^tiEV(aL(A8qF8;yDxTM)PZcZpnH zCzQBpazu&=P34bnyxfr{z^-g5s2asX`qlznX5v1rEdrSxcF2_o*qF$Ih zVp#uQP=)i2A^b4Xd_*aAYCAlgK4NBo5h3DEZ+Q`E;!mm|&zz1j0Iva-fW|EvOlZM; zDP!XqQJCf%^{^5E=)|BX3_H*uu1p+76CD{<7P;1NKrnd=S%|}2-mq>T8fG}Pg}Dz@ zw00c_-dbtSuv(579shGN^Z*(Szu-X(wb)Mt3^l0NA#{0#;R#SAY?G=XP@7H;%K>u4 zlVstfHG5%{trhx6GKBzPQm3_jW0KpEzGfT60RlRB(x=ai2-m}yEx=*@S3CRm8nF_@ zBeOYiLly`&ClF{J2~$m$bQM3aB3ngJvI2KFtCm`bJyzRrSw$3z68A`}2G|dUthUjz z@-QSt?viS1N2^T{GE+WZ`RQr1z{^^Z z$L|86IVyOFlSYL>(~|^Faa=oHq9y^&atT6p!-UF2k^Gml@n1gW>t-0W2mGX z3mdTBYD{2VF$vlY17Wr*=U=noD0-IaS;YndYJbKsIAGUdoRNpPvBBhgBKegLF@baG zfUKtS69{o4$TVB2WhdRYM0`^@asq=*+moMk%&m+~Yo`%UJ7q*iqER(6MV-b3uS+Wd zO6GNN;DKx;iN810sbQ2fg-yLvH4+`>wu}d+ij$uzg9gEDPY=kJK{JAk07K;sLbj;p zjhhamTc$L!^s{qrs&n*7W}^7e_;D616(EQE4lf9h8E*^lAi4#y%FcP)Ucs+UdwcLUpM^Xw5 zxt7BJD~o-4n(E%A3N!?z0?!Epus)Io)ep{f0k!36M< zhzCx*ga(7KINf7sJ9?82lrV8^)r*`qYCT%>>XHA zn%?3~x+M$hl!4e6#sm*0VyldQjlxY9YKHcMMa5J`p(Vk=%_T;eldyo@ z2Dd0Lr}!!iGQh7bBuo}r$_(KQLmo}n6ZVqFDuG~;2`GRikDq1Fli(-Omx6N>9+N9h zOs<8^Vj`m{nWLx(P&Jd*4ksteCcz#W5#`nZMJ>)F&zymSLlgX>luRLITFF+7{r)^k zx5DdL)3necx6tYR+43kNKy(5df*p`Gc&?G|Ct+3zTy zw@wgS#X22`7|#_l356pzMvS45ui2nQ`$sN-5E{3UH07!|L5m50qk`{a5sk-B3Py|< zf20WmmXLxm5fn3K{-bXcW~set!6GUGe?cF@_S`N;84FzB+Xv{h-k=!03}8SWSq-M29HPs zX!qPDLP?3sTE*W{XJh?D8ar?*i!9s?$DsA|%FW@wI!c3d{^+zyRN4Rx+PFY!m{*kp zn465t3*}O2gQNnvD7Q~gwTkJ2<;Qe{9G@dX;dv>?4lN1TnP3eSK0+b!^7Wxu;Q`{F z`L&%~8=)u4oY~0tc21^w1xTz|h`mbcYi`H_JfQrtBXDb|VE1vik-F4U8)R#K9ap&f zL&1G|kQ5($k1YlRB>V>-_4e85ev~)>h~TuD_?T+E`bZo_d2UP}4I+yh*D_LF??6zw zWKHMs!IV-Dr0LO=?+aLRc5VIO(?u8^Q%0FW+guA1K6${;}{1 zI;eCgDK>{ZImS~13gxp%DfTlQ?RyQY{$cdZnTqIn6%+4Jym^SXdPlpK4(bn_@`($(8?*RWPn(rm7m z!36vOMksdbVN60}EBUeF6o!iZ6S-+X-@%-+s!Vf#e4n{X3-@+>|FtuWm^}r-3O{mh zBu?K&j4}s%feT?FIYQMbPuvyj4!R*WMJ?rtVCSP`FN_%@Z0rDV1x^;>2CV&%FNyPy zAvEF7?^zv~hcE%XQY5`u)X-?OvPX@T7h%~i1cC=el?0Ie-ept^PnebxGpYa*1KnD> zBc!Kt!R5*bI&j}}uW4XGp7LkV@C$Qs@RukFj6m++ov#~nBDQu|EkNm6EJDtD%VkLi zDb9?JuVP!W82_?VK3u#7Km|mYDVtsVLeQwS_FCr^M^6q-rm_f|VWBufvRO!Fs0nAI zr1iW8tubVyWN{<`ujXc>ROtFxFTAH9Y;7q+nsA#bm6iZy^d_fb6G#v+8r4e?X-Zg3 z?%9Yy9+#?MuWOBtpaQZ>?SrWYSXvfDMC?2ZPZ#K@4{uuql}@GIE@Gx|Ux#kNk(kf3 ziY#o}3>IEc-AN{tJhp_?{wf&Fl9dy`EynD01W!0Y<4S8TU0=wpiTQrC9K=u7`T=|% z(~h9K3Mg@c2lp!O)evI#(!t0bY2Dd7iALzM*CghR2}-h~MOrw!vxz{`-g)Bh39-5S zTci&ggFviR1kf?hb@7TTR#tL|-CtJ*piMuXVVG7<)F}1RGnWn*&dcF@Xf?j*7O^Ob zwB8ZQaQ#UNbWmuIhD%!pR$&5FAhRSS7PMGMzc9uX?EGlsQ%M9fY>-amC{-8qFEl3e zCIt+p*KUiVT6=noH6t{Qfkk!lz0JatX*6JW13Yf%&{I!)+WjBDJ{#}P#A6Tl^;I|2 zT!N@%YWid?JTavu6K;q`_jommKs;SD>CBF*CNfkb(ih6)FNn#F6r#*4cUy%W+-G4p ztYeiH9Q?T9Lmu)B$VE>CpjhU92rCbS1efNv>5JBan!8(QienZc_V>&CQab3GSLV;q zZWOs*sKho$=AmTLeJ4kQCiGdQb>2-c*e zQ2mblJ6$89|Za<<_0tk(=4S8AN|om&PXpB+$5+iq8}vHh7lW2O6Hc&ztT zB=Y&`@O$1Bts(2%4&bBJ{nJJ+_w)#_+0iqp8hTeStfmH!&&!?3M`aZtDN!Iw5!lig~zJceYlA5GN8)wbBjdI*NIOKbrv9!&hQqjcJ zm0iQS|I(r5MpUVAc)O%lA>t#wKelywaJyXP=C+(Mc=^!jlC|C9%cG;cU3Fx&9O!ob za@Jd|+@ZZUR8~y=M9MdcLR-b?x4Br

2&eZ&iZ5Y*p17VCM7S+V=clYnzNkfhpyP zih+;M<3R{`D8hBIdje(r!`u}c_($3sugbY)MZ{3+{MHDhu0z1r;OF{ z<=&*$4e%#onN78A@|4CY%-+kK$M1zSFRrfF^ZUupjHmH?H#HSDlH|K{@RyqYv*X>@ zBhHpC_~pgrv2De0nq^D!r`^B=aB?UYjm3PRI?JhK5lP-;XJ#29$P@DC-LI;Q%_Poo zn;I|kZB^EBPrDYTp04f}d6;p*hc=3?kMVlJB$#cce@OoqKTbXED%&Nt8a8;amc!f2 z%Dw+!?^}$E`#b%Z z_2xFr{<~tq^UTt{viT9XS#w4ebEM{Gd+_>ti5JugUt=2D0qz#8O1lMVS37VibXn`9 zV~eVO{)PlkjZ~=WYI?W+;@FHwQzy9oVxgj`{4E98exxO3HGNtpyHzl)-lag<0gBLE2TXJg9X4I8Wt__xt-)d3y zOGWzf`PkIu*^z7a8qKW<5=Dlb5y(Yn#*gIm!MeK=7h87D$BMnPo%vtv7h&m~fcvc*%0QrQi0g-_M99mtb?^bE5t`;cs?= z`{G)2K6ast!0XFO0JbDIw@Y1?{dv&0Bk7AHrH$B1c>2rYC*u{|>#BKX6ghF7JzR5L zo5p0xGEnB3e&&6BV~Tdvob0UHi%U51ZD-SqtEXFHG})yqCz6$swuDZnPgjfjw>D+V zd(jkXQNo31f~*$jYDa%+T;Tj%zb-4bYW0$mT2lz;Nr~m< zHI^8rX2{PKrTRqM(7B2dtt1<9<-v(XevH0q`jtC42d8P#bJ0KPb9n|R)@X+&rDcOc z@|4fD)y0?j<;tZqr5V^U>6KKes&rhkx-k(^8_RP%yjIc}d01aug{d&=tJ?v&KQXVZ zYf-k8SxWA>t$wccG%muWvAfUg~H52{`H$^PkL z@Pq%^B80$>h8sJU*{Jb5(dDm>OOjZp!PNiQFQ1j*D$Cob2;Ef3Xi{eB zQ{pxxA`K)>whG9lwZ5|^{r>byz1Inh0ap;D>X1fLQa5#I8jTZfTFdM<+#El`>e?~R z(2jZ?&-qDg0=I}Q+E$`C=}JAhwKJh)w`HMZgp!Fx>|#l={M?v7r>|h)te`(mTEX69 z7muykCO|QQMPAaStn;wg5%Mp{{|TwcVZkRZn|!uOFcu`D^4XIx6Qo&^WdDE}bFc-Y zEvIG-`4Xf!Ewfm6{j8MW<<@29YwuNW!&XIA+Qm56s`kl%K9{TM-;lq*Rp*}T<2(1| zFP9~#f^0@OpOcaZ12}@f0k}Cfl6$ba|A72~#QzQX=MW+NmyrLiWQXd6M{VkzJ;SF@ z=M4Ll@6u&adQZ4s5gRL@=5VgnQ*;wfM`jI{#HDfOJ=nC7@Qc~Iu|%*7@-m6m3(WPzpG@3@)cZ z>QuM+UHzicf)gEPbi)=w_(lcLPQ=jL4-kjCL0#xR1Lkc#gM%oWM`Z|8A;vc-Q1c}K zen$+X3r=MKynHU+l>melAtm^(T+b6sGXzx0unQ?nIptxWXfmSoWIp4|USXyR#Ots= zpEwwm;{XW7d^~sIEY#5vGQhMhTfWKHggYf0Vgx^7$S}Je@eqlhnQ#q}y`@%Jt&p)) zgsXwN`WK7*G((u#tAi|-kyLrhJbz;PBLnb0KA_P!2!dq&u{#w%mrOzIKh!NnM%!UU~ zh$K@1-J!bO{cumc7rUb8(j@VFKolmsba*mJ&+5i1iP%LL%7|ZE040eI9UX66mS^od zj!Pa;BxOON7Ss$U1l})PcPpQ+O7oT}P4Ue;R$K)6IhW{;{X<&7b{ttLF_`zPR6hsB~UKpw_k#SAZd) zxCP?jxS71`6$x1HjZMaLk#`$CGD>gxCE&#To7w0rYz*MEmKYlE`yy_sG4;Y+6lvz5@N3&eS^0Az zp!T!#hIyNAU-THR^?S&Q3_sGJv;oB{XwB0_R0Y&oBQyk_oBxCFcR$dnL(Xxd-H*t< zmjv$NYCj>Z0b=AXuJODuyHk7a`4`?#qxv6sKVoo^dh@9Hg{%!9?fUvks|AIcobrk)`KAVcq#)~eewZFZ78*iq>lNhWMa7b0Jt#w7u*l3+{idHHJ!)x}GQstUVe_|ZVS5+O=CZlt^Y&GrNGYkee3JS&lz3V{65I^Ef&82v$3(q*glL`Q+K zrMWmhxKY_rqCnLn(%Bw@Yx{qo{cK|YM*Er9{z3a0vHpejI|4xc)KiG{digKOe!>c? z_M^Aj@)zA@W|5D}w=j`}by5f{y%z!pBvgI&HJlK3PR5eJSq67L+2Gm|(B^rQ6ViaA zy2gXq02^jZVFtxDg~j7%mhTofk0U*l>qqou5tt*uYV=PdJm+D3@IOBwkU9}aVZ%)|xX$?)u%LLE309rM_g}eZQrVI{v_-_WT62$toSM%y z+-F@+1yi}Dk{zmn5B5DV90)ZlxH8~4li4&x?l@tkr|!9vP!xN43nehNotz*7-&euO zgkk0l>ORU>%(Rr@=L?Gwz1+k%%0`d}q*WE*kHr!Hg^9Ld3ZmN1vVPPu*_Uy9O~oHPVM+ zWh;H=@o~cGj8b{k;BPOUB=^SYr}`(CWe1efY_KG~sYu&{^qDN+tAtY!EJ+?eLrh6PLyBYPIe|EjUmN;3Fby+jx!7N5{=8=aPMqm~n2RdNs z!2RqOr|ZuP;3!In)+^ND!~K4~sC+a}0ZCSOznuV7aeY9Met*6Pn?jfGV~O1+P%r$S zf25KObVuj5N#ds{+OG`ff9*T3$a$u9sIx&esgV?y+WV9dhSXYgttPP2UV&jTfVS6yVy!O*T)9IiUBFF<0fgMpUfYJ-w|=x4sOp`pAe+?4%k zGN7UG5>_Mz5) z%8-}BJRB){@d*J;xATqY5B&RmTlO~^h?B3OA)1u;w8@4iLg@8p6;;ZZa*l8 z=5e`O0^|4S|J)|rrH~`G9@EKPy+KT|v@}FC0ka2v`Tt6yTFQx`6RAZ2Nx78U=U$#Y z2+v?+km777 zvL=>dz-%$~u(DUKLSy#+%7|5w!Nk`VH5`AmAxEczU?=+?(9YuM{?W*z}<*84O$;Pnr-Kl zjF*hQcIA@M8zqY+CI|=SZMcC@s2OJ9Iyk5nkRm#B1ZW5D!k>h@W`(}%5ua7$@+ILR zXaYU7RT(Mp1qv8jse_w&8z#cBMO7l|wo)e42ph>qXuZuMMYw>KxL6uMA7;$IMSB60 zSuyp|nwwY@Z!Ist87gQI%SeHY6two`#Il;f@`4#`qJ@Fw));KF3|KoFL|1a17m+Sw__5Z)b z^#f{kyw3bV8}Ga=sQ1@D3>tbq{cvuwr*iLV$xw;b9PHn7&~xYjRX3Rw!Zhj5R}iVb zin>jVR!hYwh5UtwBayi7ra_u#*=D$h771+gTjR3wJ**7OGzc1%8vE$X)PrU7!lu|a z>yJgW^Yyd&m;RIelm3%sbH>+v`?$+2P}+VCO7{04>E+O^*!j< z6_VNfW}yNccb%G@Tx zrz|$wuuBfgailfGlBlw)ExX~RaRaCtJtI^i%S6Tc_#Rktm^=h5G?7SOXJTvva^SsNwwX5n$KkUn_ zK(StND{g_VbBH>(c<{VhAO>IK_rK;5;E4bCJVK0fAkQ1``*IkL@%iMK)P zZoz~;r|Z*?Y~_*kr4_eYrD*lC`Yon!N5UJgGk-92NHt;lF5;P5dExad3n$CV+x`AK zk#MtnY5D2H@RdOzi`|p`J31sy@gZ}kNoo4-Q02<64FkU??BT+;PQbgX-D6pkF4?a7 zxaumnRro^_CwR$IrTU>pg+7pat!>-H?&tY>vQ_KScTwg~a7H)l$NyAEXh&tM{m(i= z%i4Dx!INMkn;5@o?`z1*Z18uf7+-A1>u9y`JFUHZ%SGsoa?1!A|B)larRb zU1-1W!1oJNinYY-xRmT5Q?yAOFilf*{fV zNF>1gJCVSKT0_^@5#DW*%x0^w>9s;lF7os(BqZE@oBh5sh8Eyeje3u}rainX#Mn+s zHp)Mre$L?j*}|Xl?a2CJR@J*{+AXPCQO1?D{_Rf??C_ZB{!v=n*ef-+5>>v&Lk(P2Hzr35m_jpAs9kK3GTuqxhzIdv*-dO966N$WjL~6U^_fLn1fZ zpnI!ITg!wg0W#FawC?tYVoV%2POgjd45vqH&o-yEjcv7EvK>b6XhC2y@$=Ktjn<8B zJ#V(Ijyis+ZV)O+wo7P%L$dS`-P~vEx~wCuOLF6IV4ecd!n(3yRWmH$^KC7GN$O*~ z!`diOdyrl^+My0ih^#)xHLwhY?qCeU8zXMag+{I(AKJjLxyRgXi#eW&%siql7NZj) z4+%tP-%EgRyWk$lyN#M36RW5a_|hO9-pt0_8KqlxO-h7!73Md(56i~_993y^dET># zYgM9bZDNduB;@L}=|*mew6>3%uD&m?^lP=ia3BR?k`7rUB~3%?+Cl4$rj4v#-Ia+` zG_FW0S&F^=P0@5$9AoGiY{7<7nQ2Fosh#~%89Vga0tRTwka!jrl=*j42#ba)`UjMC zn=$I~lZ>MfwL4-!rGw*|)S`->NU}WX>AbQ~UhI&nFN8*;qtb3=D{;BR&|gpnMy=7NEP_ zNy_;=v|n@B`s&?XBj1un1$sEe{!XY*ImQtHf#L;$w~*kCAv5GsC20Ok;ICWt(_cdp zJyq~nuh)euFlmn(5n!{Ah{BQYPUHqw@lGNMned#O4Obr(xo_J65CEc@49C5OQ~iVP z%p`dZnO~LbQY^m6;IfSW7!(AtMMIh~0t{uMid>lFUA=c03ZJv48j1#+11zJe9n6r( zmK8ebK?FsRV_@j*p$P?IEUQ-vgiqc2WBh8SNh;p9{YDbw{iiwek1KRcyN87EY%rPh z2Y}&v)gG&7lxJ-zQ9~MbvBFm>fYKWK-snKg>xMO;z0>J`YUpLxSbtK1l#``-2Lmx% z0RXJPK)T{mwX)9Q;#&(q>=&1X>dN!nM=^y#A^HJD>wCdL;dYJhGvygZc|ivKt@( zU9lGebo7swD?Ix!(-(VK1#(F<=h<$I*en$gp;HSSl)xKf*jIk zshwH7J9~nMJWL+*pX|8BSr;^?kD{Y#j7OrHhf+FrOFj#AX_IFyDsr-Adz1O=SpY5C z%`-odzGEIIeQE_@4M93AsNwq3U<7K5 zg8gsn5rqPIAiXNI?=;%a8VP-f1eKm-7`Dd|g%V}{AwQPHI~GJ?qjxP;p7esgYG#KG z@3op%u9sCw;s$Nqg7ovRBsDc$Myy;NqA1^e*IrpBTXYRMwBmJb+o>vXBb(+=SsEKn zlBzKxw4R-Lx3JzxinqnqJaR@#-`t^PxiDy+qxS{ie^xS{XRATQb$00-116auZn}D= z!&Uux+8M9+o2u|}+_K34g32{b`x>m6&)W<{nAc!VCogc|ym-tp+b)Vg$1~t(b2DDF zp9QiTnG-6VtG_t`5*W__S&EvIFCC zzKVQiKqRcxGwh89YL>zckZ?l)oW6{Qi*KOltE~-{PM$M?Lx%t*ZPf|H@I3ebL!t;R zwf?`6C~n^UnsY7CG(gq2C`>`SOzrj9Fs?ps1ANT{E(VTu##@Q(7{&k7qIidfJFCl? z)a!c8l>x}$65C1{`t-<`VSo96piH)5#Og?x`MhJU5N-T{)X7QspBhE)FwKFFvuK9G z56?$I#?7}t{3*{-H;W_XKn2KK>5x*H>39jd%#T=@dGx^15v;5O6WIU5qxe0Ko8L`a z&HmUhHPHG5touqIEKL)v#toAX(|E^Z0^h5LF#A7=6dtj{Ec%fT)6M$SSVc5neWTtR za){Yd3Oy!BpNZib2p--d|Eozs*KDprhwjvHl`UHKj&^glCdDv>LTg(=)=#7?k6zK% zrktSdZqPlNgeoxRx@^AEaT_f(Gm>yyM`+*Io$m+0{Dg`sxs%de^X#*p;k(V&`HCJI z(l^8cEJSE%L@)Ae2|_4R%AXfK!^N3i{lZ&m*}cpnqu~3-YdCx03K=k@#w(sF42luM z8cG-wGjXc#472r1iSUB3?9v(2)2-ZthSnqB5?cmLAu7>T`GLddP4Zs+7fw`wj<3WZB`AF+PuweNzN;>Z~F%xni5k}A%S<5S&e$?u%LRV zO6RZrwOn{55g8KRnKUFnu;J?sIMeTGyvaK)i^p(_C0-T<>aJOsUt(<%bzs1=B-Ss8 zp54>Gg$+E&2+D2E`9kR*oSp*!-f1$(hN9+mZW{~b_nX1+N-$oJGMCl%HU}vSg|mD( zofn*0mpJc$^WnVRWHkf{jR~;xk%e4Q3E=qF^Q3UP#X^_O($8sZ5{PX^4|@~TT(lnz zfU9S~4s&oejJ&wguUYS|b`BxF$wv->$Q9f7$A^347{$|zf!uE{?az!+clLKSTsO+5 z86k@JLyaQ3*E4oBX?QToY9`P(b?JIO zPdCyf=&+-~g&y){PkKjF4MR>}^fN_M`gJQ8#_db>WlxRw(JhwbhWTJZB63tcuM}O` zzby<Ul{KDuUG!0lmOHx-jqwfcK>iXx_n>W-EBeRkZ(1l^+_OVNUt zsNs}UnR=FCdDbO#05Lv6t==ChG7KmsDeX2zkc#LJFeMjwbXuNsbgKP*e`YUxa8O!Z zj&|y|Zms1tc{eko7aD1vam)j6LoB#1yPcEA&`e&{L^6Ez%>^KOq}wOS!Imu_D3v%i zN`s_n`upZ&s{<52=qJ4(RiL;mTIO{z9aNQh4NsZ$6kt*3%;R8r`?08O93A44TS#>r zx)wk}4r7NV0)9oM4l8U%-2A{snEo7hQILoV}zw-FJn(4ypZ98&Rt#btk zz2>{FQyhGqzbS%13)rduu*f{-Y~MH@S&VeMdoX>yYJRBtDSOT429Q|gL|ZrYJ562} z*}n^8tg{kX8}0hjX)QFhxmK#Zh3K+ioIaiT*wfl!kt&(V#~U+xaWXAOd&o$_>8d1! zDvXWXN3lZ_RxN2pSUrB373GeHb8k5d9fX#5H#4i@o_5GoW#h z^G4U6Ra-*LsGt3}=7rYty(?=UpL~}w&?%okcrIf;#|&amw*%i30yR(fR|gN)3YbG@ z4hv?-o9lWWY?~JSYDWFglFOAvhNTVg(b8n2!xt@}?_`MV5NaC_BaqUHtldZ+QzdAn zoum!0iIn65Qs-i>A0X%D%K&7Bf~##D1!$wd^Q{(DoW|4L1shmbOnS9T+BFi zy!pACG_IDE(V?|?)RY@#L^g;&$Ir3tdB$F$m(8`lPS1!{JLvPHUMNw|iUX1G+u4Hd zdkQH|0a?LLw*+FeGhY))HFn<q;H9HRra@^ge{G6p|%r7 zm0qv?q9}O*ZvB<54OVAr^9NBh8C4T;HeD6<9vNXoeO)PN*1$#%Q6!*=M;PL6@ez{2 zZyAi28DPWmr!Rth#pPRXX(izDFPL5|`>#^^3P5~$2vL?D;xjk}=@8HR<#5F{E5|S!LF=GTqG_GI3B699a?_>W#wd8_A?Bltuf}E?_yU~X zrVH*ga%$u>Sh%$F%FmyL>ev?_(zb<3S2)QA7-;Ia0^Q7A3^L6mn-1H?Q%_cJlB;MM z8E($HHxp6LGzPy9I#(B3+?5$6>=8|xu>KiVgetU{cx!^WGM}33tYk1Pu$Y|8sPl0! zUa~b4*&V5z+k9AEU#zjw|8sWMXLTkf#_{-LO6TX(-EGQT1`f~2xKaG1-QDe}o2JLBLVF_+zp6(!$0S} zpz!_*xh3=N8On6;Z$lUmPj65}#Icx?))6f9pz8JGOD9LM?k@1+?3HK165x1XWM0IV z_yF9q3-ZF?!-8pYfXzP;O@7Ehm^l#yB-}&mU<5oFOxGT363E%TFY>5QfLS5Vr&%2Nr z-h9EPY8oa~B{%?YQ@rT2nN}{do1fsNgiJtahQMvHkhtx`{QUT+>_O6GN96Tjr05g; zkeb;E9<5BDAY)JyoX?F9Y2+i1cW|TzF*%2-3Whm{8i<@ZhuQ)tIfp7`7d+z~d(J%b zU3~;R^KC>s-1AlO>>kBdMF2O_uEly$17=9DCA3NKTr(k(|#n3X^oZXVJxA^l3KBU|!;F3jPh49DR0`6TgaO?V=4CduamFUHB| zAPUCG>jSk$$@|LNv$Wu9=ZcaS?3D2nw;2?^6Zh#LYpJK4;ra~o{z#C9#o(m*ebQeN z#sO(t$bP(>m9~GmKP$at1}2>D1#?pkd-E! z>DT=Ru~Ec?nMlc%whRouMrxGkqCe3Nm=<`2j}{>@kLOGZ!$N|=?Mh@26z&58hE$bc zk^ZhMh>8c_=kf-CDpD%R^8}zC;jmxh_JTa1Du!_eU@EFGu!_W%B+Uz+K~(=J%Lbzn zlP6HHqK{ZO+9LKFRUp%u9Z6echA8JdiR~%Q>pcgw zB%}z7q*{ju#Ux<{^d74W?8bAB_~4V0QL+B8TJPr4)}}$Hx;6`adzyv&CAI*ntCQWM zuDxMNt~W~lr@O8e`xhQXiiPCNn7701`D6XWspZ}4wXE46F9#)` zg2+Q%4Hv#bCW;I6((B3Z#_GUJ--^2Ew!uqT&RJk=0Ut2>E$4V^XH({v5y!%)@or0;D50s z20JLAjF8`#3Tj<@I#c3rBLm$$C8)Lw5}>0dx9PhRwSf^PUnp3Z^p$+_c^6X$m zhS~k<9+3)!RZRDOPaV_Zgn&3ee0T#P+Wjhrsj(3!iq_l5XtA?Wm>#bbB#2ddA5R$B z$U<&36^NzgTw^nAgNwN$gYx`5`I$>;3Hjvmx_wq|;`X&x*T9l4a)kc8YbYnTQ5F1E za8JdZq`C4yf~w%70OE~3GwX0AhIDp~3(fZsRnCLE0P$Y1!kL0}0*b+@Ruw?`0GU7O z^!LPxA)@=aFurBY+ucW4nRO(ZjV-`Nyf)Q!PBp@&Pat8AK~shS4h9`+{^`(Smk0tz)d zm9-(k5z5TFIdQt3_bVM-4pgaaR~$gGgGg! zdTsnjpqKE8aGOi{%pf0BtiMD@?}?+vex71XG7!|@6Swxkk+0E1#(_wb{vZ`^9)xMB z(PLjR0NXUg)vl|TBoz!E*+aKgzyX^*G17p+=uLQs#%Ykpgo?Y^df4cC$Dl^WH|fk; z-)N7pdUrU#?)L^v2s;lSw6MWT?*V4b>phzw6G$uukHf2~?!o`-=6dGTZmM%WU*ZMo zf>WI)Ob&efnkNgkC6mJw1b`NkEsPyyiLWQu_pXc8eGRK_She7m)>|oqd6o1~xc?C{}VzuyaD-5HARdUj*?5L|KIb zJd{eHr~qusBYj4v_=Iz59SoDkO0=&>X`6H|uv% zAz;?cQ3oqYXd{S}AxuG-F(`F_G%!peGj}+wj)C1@1SSCaJE*WihPYgSlK2uRKtmrk zit%>JFkpT|6wXI8u#U6msXtAC06i<8F~z+`e^0GwYXy0`RYjk*-Z!mj`5UeMcM=$W zGHE>h00mK;kaWH?io>UJ{-RW-Bs0Rsjw0xW&8N+L(A^3kD>N%ORz8h3F#L-8!M}0} z0Q|ZhsWcjWnjREmcmdV%Idx%Dt3kQx&;d7e$Vy~PTYeU;hO?2X2BqpX2J+$lw5d>H zhW3;j=uq~GC@VnX3i`m9A_mUnAbo-kXr(0m6_5-nH*t&!J6RDBK+Z^*V7ozgS`cdo zNua@FVKPX#4Cy35`HV(Ihz_X^kEMikGU4fP77;sL_^@&okg>wd6ULd!QWO%cBt&~e zy`RL!+I&6T2BP`4P~KaJHU52^O>pubBB3z~r>hC0z9rBbJtjL~)!Dn{;c zVt%Okvw#o#fD|J_Cu%8WezMFgeZ79AX7jJ=(l5vX)R}tPc?Bc9-mszVHijUW_Q8NS zo;tZN@+i7tNUZn7b3fo-Xq&GZG*@3{jnv*te^bxlDdjRy!c*n$(Cvu?lZ|-E5Pm;2 z3lf2Ei9lI#rFN7vWq~)bKsmp{{!j$*f1w5=q~3=B!H7XoLU25Q2D8!}K7b(5L@Mo5 z5M4fipb%EfAc-Mb{2|YUI0p=7m9{N=zr_jfvy@QgxVr&4Rn2^H2ZGt&y8+RmI;8}~ zsHPHU*QVq>mH;K>JT(Eu$iA-!f|2vk00d!j*v;gDko8mp47s~SLh{>f^-%}0LQ8vX z1qxr=^9I$i%veT)soNMvM~Pc-!w^?KQi7=$zAb=Z{;_WWhL`ce9Y_=RB_Bw2kiPc| z|3tBx!S#_Jbgk>yQdfG1CfF$eo9wd5w?*&qa>Wu+PNxsQ6=Cb?#yP{BNVGazz z;SWQsn9~ruw~8`qR30v;`8{Hl^d6o0$A=8GM&HshV=kmAw_C4KT85?ji(uo|BWR3- z`$vFq5uaZ#(Q4)TI=hSB?_7s+B0htH%7~MweAE>t*~L)a@dt6dhYLvf{Vo6v^3 zs+p?6rtM;T75kzs?)u8d_&*hed5cVy7L}ulxAIU3S^Q)US^ZM|B^d>a^ ziKD=P(x^kkgGVUPN)-KZx%XiJ>N9LU7Q}j5`$y%3ee(F3cV1z3@guCQrDi`~*(lMl zEo>J&TZCCFE$#P@q{!-Bbb>QN?J`D|0)pfvez!N?>S#fVa8xT}zedO2vy4VkteFKF zZoqgFi?AY!fVkW&q71^N9D?;WM_Cu4&fF??Js6qj+gCL{Uki&nX24?!RslXCbhZ>~qO|US!GvcXDBE9Uxy3byS(ztToyQYKyIi@tv#hy#MwI z21z_kSH<*u$Ww_`_bY*!u$sY9!;oV2Z)#ZZdvc8^tOyB+%jHQB%9l{V#2#A`@lnxA zDijc7m4Me78GeC&2Me#>5=BWrzP% z6i5zaFL4jppqwMs6WOm~vFX@P2{l#cyM7YYpJ)xB#Dhl@e@6fl@MQeK#BtQRf;z+oL}Py2+=60D~JX+lWE=k zZJVZCkd=%AxNMt7QnyDIebV}3LG&;%(ELNG@QN&CwELyZ;A7#S`O`stTTWJwdah`b zcTKyH0d)g!4KR=VVKq5=14dr{l@*hp^;Sy1!+)?TK@SO^oOnXkC)}C|ic|GgYTw8> zKz)=BGP0;!r>qq1PU^(SY^rvI$;??+kM5Zk+HW64|W4;PBXj)Kyd~DcXaU-nh zF%YD+e3Kw)NCa?FGGAWO90aUh!vZ}$BvA-*uktWq)G?51Nu!xEvcohhMj+8OI^Be7 zB!V`wFLx0v1Y}TkYbS3JO?L39`)b-Kv(XA7jC#nj(>XrR$F~$a zj?JJJgbvyLW@!{K-RmcTRj( z$2NU{Zpms473I<0?dFJ6KS&g;( zQf!bF_})Sdj$Mkr1wv0%WjG*d)LQdHZaS1fG+Am(l{jgU!o`SJ?Rd=oXU$nCgk2S} zKi~q5_jzNSHDs$pOd^t4fLG6yI-#P;feoKoL=X zz$&mR&xtPs+&i;$IexZCp=6k;Ue?nG&6_7M{sWSr9E=T%a}8o8pn5igK+8>Pr5>0; zlh!$JtAC4C1V6Z97W>krdj&$9E#$(9N7Q7>&(Nd#lfT|@Th+mL(YA^!ArS_O z(J4J+dFV#b9*$fQbJ6dLi9$?obx^I%DM@ZF7P>a1JhnUnD_I9mAzjV34=?$g5e4a1 z#9%-&Bo>1a`P5drDSU4a_Dn{Vg19Z>V>Udjy4u^FY(PdGA0N`Z+;mN{D)76V&}xot zM9)Fms~SL!+?iPkAKVH#E+Yn{y~r6A4bn;#GB>)$KSZx@3Lt?gie;Z=RG7#Zm5Prq z;XsUHOO7p|D0o?6?k_uhfTN+k{j?`tZ6VvQUHjBR#&+oL&%%Eq#{DN z3PJ#OMy5%)Dr^jKhK7Z?>gVtnI!3_}mMK6C9UXgX(<#kQm?sO}NmN9oBr&coMSd@> z;;3n);vTFzpQOxvm#Cj=h<|DhDK0HE&Ypk{MkdOk970B87R6GGNirB+dM&(~PE(yG z!Y(qdkFp?*_&eVOCIU*RJw#hslvE)zqlqA@-b96X()~ADu~v=B+(bpiesc&t&)jVE zSfPZ1IOAnvM0uR?#t&o}|BNNSU-dc)nkTBxAcb>16i|KiVxuu*{GkJdpJOIGmO80b zsi`Qre5Qr-mZW5Y?y;DV0+UgC#%hvUw0CSaaVUzYnn3yDR1bV(5LF9;l2n(Fco4edY^8LqcJ4>JY5W1mc|u=-wQf!cLYs z=@E`jkF&f)MAD3e-AZX{V2F7?!TIHiuE0e1U~$=)b44L57$?6y5PxVR(TddsAM*V3*4*pI0C;%dZ2`$+9f%o-5La zed@!+!+duWh%)%Yd_edjS1oeoXuM|7LIRW)j4~Jyp-OSsC<+T!a+L`X@^M!@pvkTygq;=#B0yJ{^z}>|^YC$j!~j-G9W+GELd8`HqE^hO ziv45H)S;fS8(mn_{X2sanq>$$JE1{cP?RKdWM{;g$!22Ag$XcbA#S-ati+=#_{!o% zOJ9)o#iGi~cp};O_3h-QC^Y z9fG^Ny9C|1yKLMY0t9#25Zv88_~HBOKYDlW=3?rdu9@!Yseae9RzWOR%`zRweu9na z6v#y?1`NW@+U;Qr-F0EO?ZSX(iwF-`LMu8_P$Ku$kQnZ!%me7U9Jtn*9+hNi19ItR zcxZrafv&1btRa1z7Z6pr?6PX7-*f`0JRC%opmIx{46qIqFIxu=GztFd>kb7!*sG_Y zdJSSoCW12?!b^x=1F2}CF2*UBEU=kPn*Gw}6SvKo)?LUYB5N6v=NXyEiyFVRA*gU) zrTu;o!dt&W4lmfw>ZkK$jxsDP#{JPEdYd^Wz-eaC6K^5cfLFMM+*F!D>g5kVc_Z37 zrmmxFA@WottlfSEaj?rliGp`YC2|1?4^*TJ?R(}RMS*qr{M}uw1XFh&MB;`F{r;cK z1gY?^%!C;E|H@3bXTK-9VTFVF-6ktt*xyAu>gGE4-JjIW=sOjxqj3<<4i;oocu$qb zRh|EqiY3GXpYW$-pW~c|_CIEv zte;CNW|b^ZyDKH_c??9`;m%G>1QBPEwwWGH59Q%)dLi^g#1=zaw0X*t3NBV#I zSFA=;-4}%U%uk~OXCk~+XAPK@>UmiCIWDAeQ&1Bk3$IFZ?nK=&2{#7v7X^I}##@id z^+misXvS#i;65SHXxqJNVNyGM_+b!X$9aeqhV9lbb?{3&BX`7kQN^Gsc+FDE`H!~- zo-C=vCZ+qqgdj!vWQxBdTXJX{yF+}BX#9ccR#FC8z%4c44Tblk3oWFsgy2U|gI%W# z=evr4HP>CXFzJ&OR~w>lU{CedW4HFEo5N;pdUl%@_5pazpzr5L`o!~F+uehoyLUsU z{&c98(dEU*`-MwS^^@({)OMhUN93Mm=$yl^(yOZXrY62l;4W9&)h5Gu)*KIAxxVjf zuGZDfrTr1;)CKvd{qCac-KtwP$MZvLlKpQ!QO>;s7njym%p)FCbI)Df=RE1>`yLYV znojPO-`2{r`GZfL--(;!r=sQ4*BJV%B9Ek`kS_)Jxw}9AU2pf#wQUi0cRqPJUvFRc z@7@d!jvy1Q*P-Z-HNG-=mh5w-;%i#$bZ44Gn;uPM`@FX1U44~(W?}@LoYOO=on^1w zZn$@#R?BESa$25gwD75w^{myMJMxZPF*;~2V^2&=xKDjNn7TW689MOREo)uzW`hp0 zW6dp{Ts*bL&CLImoo7ss6W_-W-$?Wr+EF7fbM~l%U~dYPqeZ@*IghJNv483k~cuv2?${2ztKr#5y`U zJFrk=iq|j#<6t^NADyyt_itZ&bNnn-Nwi_14X5VVqebSb%8or<2p6n&o#p9OsGPI$ z-=q&TsGZ3F^tU{^IQU$!{}Ri@z2Nkad{~Fpnw)MbY&ht zk>%9U-LCiUKKtQa-_cn?a2cxbT70lIpJfMiJb(G#CFPlbaY9+;4yDS+vxX(}tbAH% zjRGqi7$P(v^s^zoGEWOhOM|6OPs+ThZOzEgNWZ6!&U51?Rq9TZ(B3|bsmb;3qZ6n# zQq}YTIy`-t+PHCNvq-PKws<(am^#dM$x^SevG46*JmNW;csR^HY-=-MJs$JGTBcJb zmwJl7BwqJ*a=NBY*X#+JSe#WwU^rb2WzBQ1$0BH(vGJ zT+7<8rFEu4&(Zp5dB{h@2QIs3!+Y%o`l!qNri~|IaBTYF<qtH99$>}u(<)Vj)QpW>2wLLy#f_~y6D znbh@Z>FWM0 zD!aB&#~s~NJm_Ypx)r1{Zg-7O)drd!Wz+qfU9`K+tH=C+qG);E`g*^;eCjk@Cx5-jAGP5B53`_yVhzM|MYl9KASRz@lX>#Gjs;KBTB} zt12kMDp_uf*$LtkV7vO+ZTczoda3-fxLcW_8u9}?XT6;?XG}_M`~;o|P;B8Njk7~j zi8I+DM_HaJ#g5IW3JxBI7izqDQ(99Lh{XtDf1R`#^JjfkTscvf&$;7ts9l;E3Kv!< zoar3&W;xH3j}3UQ0pg=SjlwS<-kpS=`1!1!VXCok4c9D!&X#?vrfxSLre1qCOOBB( z7M`s$lQy0FR`b7}6)RGgF+KBi)!esj_*PzHvI$s@`H@zujd3Vexn~kgOYF#scrVMp zfP`EfncUIcSqWcmjS;$M%6mqXKk4{*<)-~NSCPf0cV{X<{{pbOJ%#)`0XVb{z?&Im0 zXD8;D1;5$0$q2wla?6dC`u#YbgLcq1siq=e%!~CZ?ls(!WFXQEe`LsQ)!!lu7J>2E zHgiZA52L-gsly+%m}C>z?s}zobo}uVa8%&x>hA3R905xp(7r$e`C)lYhi=|sN8_N=c5UEww}XJc;U&9>|k3oySDh%D@~*t z)+@9wh58aGa%@Wkp7qXZPH?Oc1LU>UD6Ttxh&3TS9dihJ!0Jw9d{FNhf`?yW# zMgvC5_lLHg%K3=hFqIG0@WU<+hq|@f#R*T{g^W&xpFmE;1Iqj~^&LtLaw^C&eHU!( zLj@NRx^x&wy{1cmNn!lUsk;~`c~icnDq2a2(o(&XbI1 zmZ9l>Os|d7J-YUc`r{&g7avff_e1dbbLXFtk&}j`e2Yavc76VUiSV+GPWr!nian8tPm+)Ynun50^*#B>-pBUI_JXHKegGWVy3KMjj|YI~5df>T zA3i{{JOec-s^_@db`mEO^k_0W^?Gg?zcHhgTVm+BL>Ql6ngPf3JeFp2MOh==npG-O z5L9DfjixEg#!j4nOqWAIlgPGFEGhULM6-ZANniEeF(scE5lQu_a&KXhaT6JNE8NmH zSkL_l+?beFKFN#RII$BX@I*fX1{ov?T#2T{G92nAMkNXL4P5`SKU9xuChhQdhqgKd zQ|3W{_aM@Zh-@dgN+U7zwb~e*y&#GhCK88-OIlX7C_fztfQX5zJy5#a{HN|(h3YG= zB6Om-I0TubR^;GCet|jWgg$cU#7uiwys$^LD*n5$i2KlYrVHTUs40I)wRiG+)fv5l zHt*tQw$e9g$n<S{u$(jLclV&;?S&!lhd2v_i`ymw!*@tMyj`QPY;1mP;1nrhMnJXY)aG zcpa5VT#16#1s%?DF@vNNGGKoaW-$rW+6CetEM@k-D>$DFn0*`X=Z~i19xgWhuwxYz z7#pMAt{TmLYLf9}XW(iAD12*7Fm7DSMl{5@qY|2d8*;u*Qd7-LgHE;pT*jJaSmTrW zl#n)@B(qM%sMFny{;uZ3Ni{Iy(bXhoVJiGrme8mU(6KM|-0RoD46H1}M9qz|5#AM*X3V6xiN4pB}ki}o4*T4->1Iqex;T}pOaj}bPtZ)3DbotLV7 z^%ilIUt{pcO!4JSfhAtWiGSnAU4Fj&ITMUXV9|mfZ!RXF|9It1DZCLb;djt8yiO7+ z^|4PLktpK$^iOY;<_;O-7HUKV>O59L!Ca-7@}Ux(hw-A5xXAL6A9V-t#$qfZEgPmE z)i{`dQ-~@P^JE*T7Sn0}V1q75_ zWQuGS&x^fP*BvUemh9dlSlqevS_bSY3GIOC%esempD`tQzN^2y7iNWA*|m}>!tENG zo+(viN24@6!yf6R{H3V@%b6Z_oxNLa+54`4ip-ZDvN|T^Ix-R8e=}^GRJVou>BvX0 zd@L|GJ;49`T*8+-osjQwR9?Iyd@~lQ<~q~TldbI>%c_L+`E15aQ+8L|s^S8q;J?s_Qy0EYI3tjBCLEu42Y(0AEK8YWl~NO-|_7PTVvv z!{YNW?^-3#D8Xa2>mR!L6zUreDj;A-ZawL9Ie!@Z5lz#7n)_E?K6sfQ>>W`iuJno60>KuDa7%W zy71Oyy}x*RZKK<)Iv1Z$>k1Q}y5v*lqs-P-rYU}w4O6P?ZhUq#^JuJxOHmWl^MUcC z1`*NvqNn(t?_xtKp13{^ohRRQ2UwsQ6j3rVQfA)NUCQoXpY%;sVeK38c1I+3V4r(w zweeIX#$24Tna~HyG4k_extdGVH*Rp?J^rCZsMiq}y4i&{EZSP!KemnN$5IPl5$o&s0V6g82Cz??A zM$&)^VkW3T6pN3q)-iQM*g!rL{d@Lp?ZNz*CFHHCd4D6s-iKA1MRi=|V&*0kW;f=( z`49EqXRfkzynQer{?qU`w-IG%C8jUEGrIjJ#JzH;H6;hv!5~su;mNiT0D&f-6VFAE z$%k8XE1D%?ycJm?%GY#URLB=YbS*qn$#-K;I@^!OQCeD#Zm2}-m&Jyqgsu078>?X6 zQ)kbSrbvG|078_l*` zcpfub7rMyIhv}^-%&csa(r26cPLP$l0O$=c4H8@~#AQ*kY8Vk%to}6)Ph5uk4=d`W z<86I(##Xu|kTrmX`t{r;c*{BWIF{fR#zpu32(Vkimr=43TIY3)HNq4V?V&du_$qc9 zHE#dlGh_QvqLc4#S5+4w&DOlI0=PM;Fxt4RdAiQW0(JDOopqf!#+Q_{(BxI(dp`mw zPONcWcMe0Tc55d&AxnGHl5;}zb~ZpWQg~DzM$VwW3s$GciW?bdqwAe21l#ic3OLbEo|tyE77E zR+RRl8x`q#g2|b<^ARFAU?)$kxc{l;OX_lUU9%bLZNL5n7y%LQWYa$AlbWSisF^t5 zy*1?}H+H(awYeU~>5^z@&y8&UD041g2Ne?=I~WDp$neLo(T`h~!dA-pWXl*5Im*7c zsV77{bdDI`o9ersO@1A-UZ*7Kg4Sh;X}B2vNvccw0E)B_3{&#Pv8*G?%Ul8rxJdrZ zXxQJOZ#3xoZ^;TeERvvS|1^>4I}L&JXPfdPlH>K5Kf@e6{G*fm99B5vr#m4>Zky=7 zb$F}FC%{9KwU%t|GB^Msc1zVuV7a8<4yKe-c_x&ay)hYMt~P&WIv@4q$9z5`R~+hc zxk{K}+j*_SYHvTH(?v~80O0b<^sQTX{Yu!agtoe$v0VQfaNq*~oaH zvrZbBpfBHTPb-6FYx2asx)ieEj;hVVxVH8~TMm*-)oKP_oq*wnS{pp+!~g)2rFxh3 zOjq#-vk9mDd4OFrfkRHQ;IWVX08i&?|JI%jOh0=Qx%x(M3oEXLhy-pTNI+ohfG|x>t zc0HK@Ive`WI}>hc?8^c7s^MO)J0trGAuGh#f+d*XN)Hg>gXx^e`pTr3VBjZ^&J9S) z^t}a7Bsbr!U$)8ueoTQ?lD^*>-h{s;A<2YO13Gl;0*nlLarHOpw-z@`SLKn2Woq(B z|ETzO{SZ_S%EIM7E3lHI_Ai8Ph}tvUf`=3;{%9+|?`r^maP_f5eX)P&)OfjOhue$O zS@j2QGAlSMHaD2Zuzs##A~9-?DsTUDmM^4BvH zloma}8mzOZ`MyxOph?k;v!JQK{>2QSn+y~)Pz~&h>mh}OhGF$U$GxAoWN044A4ei@ z1pGTLg*0mQGaJ`cyey{?iBt6mXZ5pcn$@r2U~hiH zI4xEWcQXZ=VEBwHb^>(u0MzFI>TeiU3D$+PDq3S0m4v!HKX|%Wi{g6+?ltmrOGQ`xUA{o{8ErnSyxkx3G z4QbJeLb(GOqMHUS|KeZ=b7;{DM5zE7zV@qYTAoNr*7HsX(OQ6XzTYwfr?V0#rQET? zV7`HLK1kcuylbcs?N8k?8^E-($JP(=NPiYi>CuC7HK9*kcxsS1!hc)4Hws!VoVxiJl!1`D zw&f@ETu?JLk8&Uen>)`Tc1u@cEejZ?;y1{(vJASEfX%~yI*V`YBvcEm;h$qq^ko(f z)kY|XB(f&#HWNxQq!%)tY;o7;a!S2*eojg*WMy;xeBT|d-k6RVNYW|oI%{gHGFtn+ z2?B*LFDAshoEzkHJzgFiFqLxg_#~!}kY{fl9xPln$M;T5n1>8SdVAAjoy9(B)M*l7 z>lrdKI&9)E5g#0IE%+QbQghFeKi$aP;D}rxlqgbue{*uDz+NQQkX#{C$OIkoSo08l zwc%3_Y|XhfU+|c%0jD-_*4BBR5?M$P8lBT9VX7~+$Rx@yABYDEF9C5pHxaI+QAzBU zrDWXmIhmbd(s$}1;DPK))PMb?p4~zUZP-IxPR*@=Ldh?%-~8vEkjYHvh+kn<=7`tZ zJc3!!=JeH0zp&twS@nHJJP4eZV*4B-vzPsEp~^(W)+@F>Q~s)`Z#^Zi%~*dG55BJ3 zZA~80pRRmQeP*2V?+Mng>H!~1YFx>bxzatn9uJ3zh5q8Htv}FWfFO&Ruph9QQ z>D?zJWibl~`ae)Er0BeE3Bf^vv`#RY@{>wth_Z|s!D!9=RCi96Z?Gwt8SdBCXKYG| z7e|D$0|Y`7HAQ~}Cz{CI1SdK|s0AmgR9Ae{Jcmwv%6!8`e9BxUetVbcQ8?eqFUx}O zW-6wI^ssHvBek);(@rr{N$iwcZ9{b}J5qkqdWGX=d``?j z2xC*L^=bD9+*vRt95Zv#t&}ZZjmQ=a1@oWEqRN>Dp)fWmeQu0z~+OTaooY!}wZ!)beZtVWZr|2w)f zP=?CnY^#Ri%0~^w+oD5_z|o>cT!x&@Rv?CKf_^#rZj62zwrG^TE!t#+ex$OuSP!Xo zsWj!UvnqM!0hh{0#t8>(Gs}WITEA)8cM7yW^2oB{;h7(RQ3$pkDzH!14a#sglNUt< zE0az|w4QA9_!W7b`tW?oNx!L5{=gL-R8%Dhv_|tvcBz0}Kr9S0dbrh(82;iE3Ga z4+PyLkJC0^2<$0c35q)eTM5wA?n|XlS028Is&AkwfT$h+MGsU+4WQB|GBSrd{m`EC z6~FjvSnUa?A~{RSG1XfyPOCm>jtU{u(%+3KlDCK){Xu4xq-#oI7>0{f`Gc%aLK&UE z5M%3xv=TkBpG+Fym=Hu4!hPaI-X2pRA=uO5@sQ~EQUX~WS%ODiZ7P6akvt9YkF*l% z(r4+%={qBrR@+&V`PHe5Ym;Ghb20Y*0w3Q;LIr$xCx2i=dpk(6H(6=Z|ECETk$^Je zLP|mE>u%BVg?Z)z=J$HKpB-=}9McY5=Ax9m+4d!ncDG>q}-)dTlXvFDb9 z`?Ggi-m=7CtNpD;4D%w}*JN&8kO~#xsV9D3vlqQqZ^PzQSCBy+n&| z2)9rjgf~Z!oY2ohQGGj~P$WN{*+WnuEW(5dV^HJTFpGRWG%x*@CpPP}CR(E&1N*B2 ziLEOa+jYawG@)|JVPE!*^H8G1OEK#?C(Uo0O>l*Yh-|6h_ll?!m5x=yTelyMRRw#g zAa<{)YTUww8ENTV`>(}akmF^HpZ?4exFn$DKEBuEiqYTToBF2Zj64PJ=w17}RWhYN z0)$${HvZfQY@%d@5slX!hD85aC2D0Tj@9CtIc^$~0HQ1r_>Tnsv;<~` zCW4WpTZ+*iH@QxZ4!cpeKE47JPRdaF{L;{1me|96Q4|s@MesFX7Mn|~?eQ(nW=l*f z%F2}%&yIoA$7NLAM~@(rLJ*}3r8q>CV{)CVz7;@ZZ*rI%OHm`n4T}&ya|^~>AAklw zs7>MBQb;WTC9P)!f`6am#7j{ysAU#AK%IzQ4G7Rn0ymtsZiwit>$aPzECWjCUMT%X zv8NiN3PJxmTF*TM)nK$>0VW(} zK;HFucl#|9OLmwvltr?c%?sLwZxBx`LFtV56cLsWFLK;uhB_8rHib1gJ1^TjiL$59JgJb*J9>lc5jP=y)&`FCD+EBpwD z^ML6n$N|BZ)_A!7;>-`}JDd5)?-wA8k?{k_Dpb{esUoz(1)4OO8hEyYfuH+a2qZ3v zqFG04H9;Qk7r^8h^-Ct$CW(<|+n%g#Obq3woD1WknEZ`2;3Q^1x))?DrV|_)Y<%W< zrp|87VCeG8Xr#LmomhotdnqPz|K30f4dj2Nb} z!{7K8;jiCI5mh#nR6G&4Uv>R$5YgUF;lfsqcew=M7W1!ry*5fdQreC$FTMkh>pcvZ zE~^8IGj(-ffXL^eul;p1hiStKG|a#Fz;XUuf3fgD3;CZ0=!he~s)d)U8)tlgau(4k ziEzCxD5U6Phd*rZ_Lp=tDKidtJ*LT79fvdc1txRh59Qzff=A-S>>oR5!HBD7vI!+c z<9+idvw?AQuCUj}gTs^{Nlgj&$_yPBfWZukA-jdG04gIPX+%wz6pf>$p>C3igHMFH zC54Jp-KkpVjL6%EBs*0yzf}#EMvy)&G^tt>(7lB{+i#xGgr)-JLl&efJ5zqrn@A46 z=COwX84qyeGLEnLt?e{$YMV6Lx*U>NAS+o4##I)=nkvBuaLvhV(DPZ0kI1e~LeZMB z61rI+ETX;@$bri3lTz13=o`YekBtA3$H9cj-~}`0gK3h(^FiJfB)|OQRiwsi-aC^R zk`{;jo)q`nOw1I*JOL$^xp2$^bvF8DmgMNit`69H=CLC02N()Ui54@4OX7y=65mBRzKL36MwirwEcqGbZTBq>2cr0DzmuIdvK>~=6s0)I z42C6I4hj{(Es}ux^QY6dSR4qdf+&%C1+rQx8tOafP;Fxr0L$aTXw3A8}%s5YKI z55Mz7NU(|uIdi?6O^&rn)|b%sd-P0r+rsl(7K0evg6R+i>E*~xzVHFE$PDol>fN_W z@v3z0R4bD9{!+NFR`6OG>`}vaJ1jdSc5$6{D5Cm?Q7Ut;9c8ef?ptP^#;}%K<*(>b z0}7#^sOgQcA{^Kddq$LH@)q6T3r<5t*fj&n4TggSXy5giG2{PitF|*?Y?n~iLnape zhGLBwI97xS3*V(zmWj|pHwEtgFsJP2!$gHRCTB$$fIVtMX&$44hf77xCg(L}mw^yB zAC~>G%e;54B4(I{#z8ob(eEpSmp6|_5^a?+#$B1Foa`hc{zoF@U24=T>CPCP`F^!YV&ye(zm@HJTi7@c_W_tTN@%88M) zb&P7@xmGq|q2MYrWe*J*w^R^X+-*H4>fLRsE&`aH4MW z6L8G@|0VLjZTtpfu{*%yi;{C+`wijffPx%s(D}U{W{IBl!5I>*W#|>IbCI)-0mrl> zfr*-|@`^dJVzL~^EP7uG*GhkQ5P_fb&KpXH?6VL`W0YfvSZKCX|L6I6Fm1|vK`7-O z?rxtF=B<2#QTf<@&kG5h-|QW7R`(l580nYq4MhCPiwTU9N7o3MeE)?}f>Zc{%Y;n| zLuTF<`=B)M!3iv0+t3|)r~2bhjIsioDS|cslZ<>4jM+6qj$fk|lzcq(e_n8lV52HBdlDY>)UXv&kJ}0!1W7cv}_<)s6?YqTbuJ~ zZ;;5IxlXlbZ9dqCX3$TGHp~%wF`WX$gLJfX!iB9G1mE_#Y6QdbNI3Ev+aC zx$5}!H6~to2UDl>F}AG^Eq{Mda9$_&c!2^^X6Fm8LEJP@K<5U~UC$Y~!Q0yK znl5)ClUTOEUFA?Usa2QWSHsDb-D5!C;9K6*wN}XC|l%7_D(7@`uC2i^qlkS6%P*4cG{rr;i+_a zv$IY(F61rFq#8)r!sH-#>w~UVv=|rtO3r(H(i7WcY?bC2n4xyud&w9(vKW}t-71|vUYLNI_8_L5|myr?mIB2~1TIh++; z^cl=4Y%?>xPPnr%T#>&oy87UO^fv~HkvsFkZ zXXPcoGD(3sBWsM>9#4YJf7vQUku@tzi#h=zQVT01nl}Qr+`~p1OUw8LEYwo+WaxJ# zw2H!8%}rTs&K_@8WlI~lcqwgirPZ_({s>05qpbNq&#>jlgDYI}MAjbQq+1f0(z4%! z$aGZgz@%kdseZ5)9@4Q=BMt`!0A;l<8&>reIh;ChLpm`zPFsT-X7sD+TbLab5>Y8^ zB6fzLB($LLwYoKm2cD$;~1-f z+IgLn%g||Fthu_(_enUYQr7|Mmlj5iI3{*Tk7c8;Pg_&-C&8``u3Fk@Qr7EVJ|1S>yG!QeM)e<^` z1>y^y=d73$e!tIrC2d74;BFoz@Kr=L9l+l@T_{ABqRc~@>(%LDe99)L$CH&C~%NJ%E;%W%UgoM5Sk=^O5r0EMwl^q~-cUdQ_}{4wzEqCczwg!e=I8WkmdJJaH+M+?q-_^y{w}I? z+Qfk0fm={;Z_gTJx1avo<9n8kU@Ym#PZG zVfyUIbdE`q<@9k*iNk0PkopeI6Rl{5JLe>vHT{|jX_&r08?EA_uhSXjXGe1DDHd5c zQ`+`R_OxIarR`~4SP22kc$Ui#QX1&`#xgy4nEdd9wA6&}rR}J;7tpXy8eJl^ak1aB zQpF2XW?>M_n&uhV5osdP{^(3l0S=%vs+;W8uso-D2}7wb@Hi&a6EXF$!bPeO5ny9# zy8Fed7`lI9g z9dsofMZn_dwL*peC8d8BTV|2}%X>*dbTiH)Xql5U!NYEulOAfUqrwGKPaGoCmg=pbi{xM?ZEBpIlR-$V|vIuT2CH&keh zvy4gcqOGaJ4qnc@fL0#W(IMH&E(M?#&N;ob&?rqqmkm|)kQe7|ErFtkX9aiu1jofx3M~UMGLqlf=}mPivqk-cYpP;I8)1bJ78ROB8>2^2 z78%%C8^QO^kyBM%P(iD#~f&0zFz-zdgGP+8y zLz;f(A;I}Mw8V^vG-paC1o>Ys6$lF2(>S*BY|=6KDm&4Q96I`Ju}(2*{nQniWI+-W zI2f1_ZipQfzhsNJxokyn%qM`7SvNrp@@IOpPC7 z?FN)t-?(bPiOsu;nrCZ{VWdj~RWQO#;*$wegOQ?T-cu)h7CV{sSXgL;11F`+L9+5; z*CcFcAz8S6qqQlmx`&RdWHcqT%@E>A>ZgGzsJfNmDe9}0K(cD6<3t&Ab77Twg>qk~ zvb5Z&i2QqWG>)kxkanoB>S&Z`xtRqyk2lSbz7UG%c2!0MElpKwQe(`r&^O$~MFrHQfAe7FhS9=1N5cf2eHkIb7qsHfCYQDlva1B+-kC>BXfv>Tpqz1M}eUyx3n{Ji|=X zubj0GflTxXDJV~tYg2Y{Jn1^pkiL2m8+&4ErSY(TK>9;f^*sv%sX>{BdBrKi`#U;f z;W|o`DE8!4hL)g7GDuWFe+FS}Ny3`J(R5>jPq|(H#7-zO2o7CKEn65faPg1p2UJvn z$vvwlI>HQ!>`|~T%RdCl7u8iubw9GmLFCOCz7=d( zq1$Gqz>?p_j6MWLW5PGq^!H9$i3#yS#DmqV>^1(HMoOv{#%Y+#QTR>@YQVVWvO2S4 z|LzS-WuGnV=7kM+N?n#Bm|Ku!C0{@|7bVPGgu3s^yp)Ke6{t!Pr+h~-oPeXD=8NH4 zsNz%-48OB9ml0jiT51DK4!4Cv^6=%?{WLdCFel$Xr5cbRx11!zXIE>pPlbzMrjCQ2)4&p!r4e-MAYoCTv?nNgZJ| zRiS!{(Rje>nX#0#f5Nc+KspA=K##oCz))J;9MS=|$Z3-y_$-jUeTx`Qq@N>H>(Usd zM^uVU(k6VL4d81x+UY|$m1fEz+DB|5$0Bz9f|aosZU?ArY@Q6clnAbO+JYS)vXv)c zUsnoQg~w9Q)r1PXvlS&lTmK05mdZylTmct3CPI2i`e%Wd0Ox7$g^}qMn#~}3Y<(=S zYmR{uIKm6_d6 z8gw!5q=kSJ1EHp$b0d795WjZ<#+=CuW!Yw$L|`iP&dwHnmtQ7c7=S*MnHClfJ|7`6 z_`017foe+doOYhs>0B2<^I&3c&J<#blXv)6z*f;k{j~`*`$%>1sOnFIKTR^u0($(v z;rF%;xe=C;msu|?&XnLC+aPrK1t(+rH24c;2iJa2z%ZA>Nj7|GD%ER8;@fpQe z%VuKNxY?+ti&_$Q;P4Gao#F|mQ)@EekrLzYqumgYB!rH>Ik`hQ%ly+#Q1o!WQQk&zSv9sn2Skt_*K zG;LG=`xFKW!CZ>=SXu#I*f~Dz4uM_Lg95@xhDQ?Y=ZYJ^?xomg-rjSWWC#fiOaE$ar`?*8)L^j&eigl z`sMTd9BE_*s(1rOZcFRc($dpSW605At4A+|qu5nbvExhgTerElu{K==Iv|>MK3em9 zo%1T?zIv<6u&x&p;6B-KaH!qHyx=gj@;x&8EEW5B9U&xYZQ|W}?rpl8IDIgDoqj(BYoh)ijF@0GFQ_<*O|)?Z2<7xetN0O#m_2v; z;?(xM^&wYG0y0&HQ?VJ=Aac;;!UmPY`)hv*Z~d}Wi$O2lIv<_-=|Z2c)6;99?6%#j ze^RDKt{(0>waRIR*SC%OkE&}o54-1ev0M`(8o=1C34(Nv9T#uswwJSl_d8=(cNLy> z=f6@=N+jaScvOCp+i1du;Diob+He?^B^wYuDe#{HL?2kJBOAD6)laLX{K=>_re(6P*>mrhT(-)0a>@_ zQyzK8JC!X%Gldq{r;k+uq!*DEwNUp^aD)mGy6yPU`RT2lbCYM&zcUvlx+=b{&9%NJ z-+Eumr*pry7pbGx)Bf^@wZk|>jUH8szNS{d4y5|7Mk?dX_uZMcmzaQwx@Pc+eC3lh zLDT%SrF8#ag7Oz#^^5;eu7iBMHyOv_zO$Sic}`EryuaE`*+<*kY~sf#k_JQyNE{ET zWc_`IXyB@vV6Q9@m*WxA@Cl&TBPC^$ADYqR;F1H#jtVmzmE$1^mC8|;5ScHy)XM;5 z<-Gxk!1}@7I7QKT@|r(y6c#i**fg+_YUL-%uwzmy%>;JyC1`360bH1Sccr;~T>g$L zQf)uR;&%jlQ@XBQWJ-A${98WS-@V4`xNQNoQVa^%pJ>}KZJ)o0oUL!Wb-kPb z9R4RrQO+oqQQg8hptRZH9ca+u`@b0q4}06YDR1*?eM-oMhuonDxL>*d(eewlKW%Rl z;Rt(<7r!635#7H)A2|7Y+`rtsM@k_hry(0|@Oe2sp5F8qFDG0Qc7HrtJ)eS}_pZ_` zf3y7MF*0Ogn&H}$dn5D+s7#9;r*FTi*a!B zZmrd(fjZ)m_E_cN*}6=ja@q}2U)tTs18gYo&!JHzx3}E`hsGBDtvQ$>!U4B z5JG7d)z<$*Or&DJk&<7`MJ7XT{|265QenDuD|@qp8_3xlJqVO?cPo?czncP z%S*ehAx%7^0rYz4t~_DRXd7bMjMTEK(v1$6LC-F6coMVQQ?FXdq*Xe56k)lo!?Kx( z6QO`L8^|!r=8wY4mHmtE{~Mav=x*)vchLj*=q5crV#RsV~o$PsPcpa(*Q z>1BJ{obg6~z(yd)(i|f+LtXpYM=ZNLv98mSA6m!hPWu02D$o*}ccV(_u)-w_a(+cZ z0{yzj*tykiTFJU&aAXf}fdo>Hn^zohrcV0umK%G3=c$ieB>1ic8p$cH?v;dBFEd65 z5Bv+acl3M0s{jG*509R9{;OY(j%jC?K0VY=yAHL}XKa1GrBXdg=5$oWsc|vX2cLga z5XM{l$V7u`s`-{YKfk{SDY%@L@Mkm(@4X;jWh#qcNK`yl9W7)?!Wl3yPs~ zKmjPN2q)jM&&W8Ly&s}^jS^C$^E6hkEai_$UZ^{tT?v(&c&c*c?Yyoqjk&8p(>i|_ zPNHp>ay;Fs)VXkv_T!oYly^*3pI5mV#nx5qQFm#375YIO|H;uQj>`hd3dW)O4^;6x zMQMjF2!#Ifg`Pp;FzmWL{%gmXasxerlL5KEyq~D!dA3Djh^6xrmHB^J^xL%j#_-uv zsiiCaS{$b*sS&+wG+2ZBuR5~GMN>bdnQlkq2QFpeQ}gz{)`|HE{azT47nDRG43p9( z8?q-G^5uhwVZ+sG^ARJ$TQ~pk$PAMUzcNQvrff{G+$NurKXf)-I=#^kse2Xcw5t1Z zSxYp6=oLhT?K$KCK`L2=&;P`YcJ}Kla!!aiZpWbIGi}W+bS`G>@zU7&`JWStxZnqW z3Gu5_A>>Ndt>jW+p{c(R5!gnV-6SDvz3b? zaEx74@d>j*2enyf*Wb;~ulzaiYJ(tcQ8*)taCl;7eZ<8sj z5UvvRQhfIBi95T5NX3oV6oH?}GjD%T$I5kakm8})0+kbycC&tl`MEru5wd0>lG@7@ zIlr8qgf(U^a=E_(ZpNa4uZxQel1-+n_eV-yp*zj5>Xoi)40j4fj)wuOZK+e|Pm8HJ zWwBg<%LhVx9{Zg$ncuS33mUI*P>U|HsO#U2dD*_Xo3&gxaLhP8XKnIR^EDB(_ql-O z?ZU?2RAdNc|58$NX@nc~zCC>Zn#~FmQ|D%YpcU$j^GAzN?4h@@nI=(Z0>6w3^|FKD zl9iIzA{>iV$!iH~X}iu6`6jYDb$(XnGbBm#Wv%!$kkq6cb?;IIJ;+RR&8J3EU~-oU z)Jzt_c7mb_5`TZTr%O(v25$vM3q7C*W&yZ&`+&Y70X%JFJe9nV1_?Pg6p9RoKUv@KYf{%<2B6v4^q*R+Mdq7 z3F&aM9AhfQL_fTKx7FdC{q$ZGAi9_T&XKOO6!>umh<=A89nf*hQY!!Ynm7X4pOwm* zJE*rjfuwZvg^&g_3t}kNE8g_TA)H*W)mWt>Y=ymUL}LH@XX?lHg4$=4i^$!A*t2z=)9mFu!y z1PZY-3o{AL0&LQ^nm$qa4-c62FmHD2nF1-*bn0s#0 z^sZa@_CD<+_wahCR&_F{g!0|W7oKkxF5leP@u>x$oop^UT0PO}$jlGNc7^g0D2LoO zL7cLREny=)LYVKo3lY#xtc%m4>3y%|Hzh)Kfuf{&v4=*r0rtZGg;g8?EWfad1Z+Pb zK0^N6t*Do#$XnD5RGO!Xo@Y5MXDdPK_8R7YlNI;l;rpEl!$Jat9-r!y z6Se)L5Z;(#=L-2AN|8;^N*gjaetx_yHdNlygY}x4$tN;xM|x_PugwwXzCzojNDX~8 zb=>iX?`nIS$XRJ)RAp0mKS5J{L#Gw#s3eu;<{k0 zygi?+JHF_D0Pa8$zy6j}|EHXq36aNEln*?acIPLjPlkh@zP_M5(4u9%8O+VR2N@;v zTbx(d9)>ZRXnk9?JE@Nf>SncNF4ZL$9+c0yvLaa7?ivkyMn3xp8hJrJ^$46Wuc)bi z=DeZ>1AguEiXXSV`S)Yy)xR_v3ai%)hCo1Si`53Frwf(@bh^$|t)_ zL({>3CK*ybZ8YS3Ui2iGz7t~}m2IC86ZgcFg?{$jm$nNtpZ2<=kv92qUI&wwR*Ffl z7|puRiq`V{>12F7?{$06t%8D&h^cw~X)>723T2r|eT&R9H=m8?lVW;0wE8>Y5i`~9 zr06!k+BFLwKa)4vrt_1@xPRI+KM{N@O*2z(kGN)9%r(YMy*5#+S!&nLx6cQ8q_2j6GY zEskFl6YaK)|EinR5tZBO^`6)KNwYrd*jC?zlV)hAvnS)zQNOy~TkqjNEvj>ar`C7V zUz1BuV^Ta*H}dSq=+e_L_QTDm?8IG}Z3;?#2QN7Vx0tk7^paEX3W+`LCNBI>X4Q3( zq;U_w_Gp`{rZ?_bEWHn@kIW~7;jp^?SuSgKhx6%dJW(&|c<)Q5Br_?F$Fm|i9ri$_ zo<>OpD?6R}?0GRC6|_)cHswFx4`$Y$6Qq# z=9Mh{!AWV4Vo+Xe`tz)qjJm^ld9iNll~*EDRM@}Nh@otzF91hBz}&w6h^BZHXIPZe zN)u9-^y;R(Jl>S_>8KtJ>vfO8=*76^)|r*ddb%?swW_(5K2mO4@b%A(^d?2G7`!Mw zl`YZ?kBH{}KyN_sA0pl6C%R*``f{m!+^9h&Hpjw>e$@pP`evH>@Tqj{q}MBk&55%* z^9e(r`Dm(_NY)_hzPjqAc6xGBG`A(oxx|ebOzsvbamHSlfU@{13dX)T;h+_)>(0AY69XjSE`$UhZ>p z_3GVnbF+AN-T9$>LGZV718BafdWp>(>In*mFKr&U zph7AD0@4fOVjZAZd_nI);s?_7zfJu{ngLQn`sKai3;81*k_u5KbG2UmzPfxfxV%}u zsl7|JnH)ZnT0KLEqxN=3e5e35GjP^H(Uws9LJwjQ$GyH6KQi~(^uIl&|BVf(pVLE& z&~K~Ptq3tIJjp+*Z#m!nVauI{~ci)hzK<&(EfUP2CDs zL3#tlm)t;hGaropmcuL=~p3zkXE7d;!Zx4_~^hS$p*elVyccM6#w= z1=k4(GS*%x!gN@BrHGPX?G+-#e6`nv7~nNy4Gn->?bROyYPHvXFqPF=`jHW=&hn3n zS#{QcJdCQdCM5GwodqF+Ky{XX2<}u~>q$eKdR>LA@)`9UfyBg|g7{Ga1&PVTZxFbm zOeU6mz=krJ*wO+Wl*zTJjqoW*q7w4|M`+50G=}nFvUilje4m8Pq{8BtdP&)&ulgR)-TwTcp z^+%Oawn$TEwRuijjz^a4er5Su8IF~{229$dx|%{-n&(}SrUOBht}_Iol)mc&2$a5m zLwS?FUt>a`EKDodkl*dO}_F8Xq zpHu{YFX=w51-4UppHu|yTA2OB{rjG}-gDe1JqPzY?4-Z-)QzM`CsMDDUA=ijXdh9b zT342tiYW(xJ~NL-b!gn3v-rIO)Q}kg3$cM*$b=5vV<4c93LHWv6Y~>UgOUqopad0V)w zp6Of>aGvQ_Nt`^>wNik1rjw;$?@Tv~!|hDJigWBtcZw71Ocx5V=}ebNWYJkIr0$aT zZN!}EIn@2tz5{yqU`*I?T;Vw&^sX5q(Alrl|&$&2+EYhT5HZ z3lojxPgm=|mN13Ec{!`NQHlZA8QnL+U4VPw2l!I#Hi_v}e`$D3IzQ4-0_T92a0GRt-1d@{>* zf+#Y}ZDQCl%W1=G1Cc=IAZ1oj71DH9T0;EW;!4e z^2_u?B)FI9fe08c(-RShU8W}@!MRLlM8a^H{)o!*F+CFn*kk%6K9|SzP!fPUvb&N7 z(h+n?z2J}>L5EZgm1HK2L*%OqyfQ(Fe0dQ{Ca96`uX4u(RZEH84jlN7V1oJzDMTH?45_LZn|kSFy+qQ3}Q zq?QWIj15!3`vD8+YtNa_S+un5xR+autLAWk|Q39ce&kxy@~T|Fe9K4}5# zA*lult5^?(nWQrTen_f;yPoxkdcVuf)$RIh*}J;j+^iQX?dS#h^v;g|BkBULF3(>q zE^f7xujG?=-&ojjEL5MJ0p)jvY~=nzkKcRX#z5zf<8HzCj=rdU45PF z`fPELDugvh-|^qrnQG=BBml|8*$@l*>>M+)F&&Dn{r+TAx+%mjpQQwXHBI3jL=$9c z&_)#kH7#jc+lJXXG^rS>>FE>oI@HsX=Id>^PEg8k_^n=IYp)4KuxYzP9iFk)2lv9? z)p;c}D&k2iA^V_+csLrHV^$0%&(}JZa*|XX@_9j|U;|Ru#esT8yjC`eMXAlPG|wPBwQfL4b<8R>pw8|H$~LSQoWj78?4 z&!qS*5NL*2G7*hM`dG9W>O;|DXetsdzXO-8B=+ZKSB@ACrlX6w47Q^TiB(`y98d{y zk26AIqD2g4i5)M*pn#oRf$>B=YLeU9Rm6b}&Ibn)LJ}G8s2#*CqQf2)#uOoSxk6ZS zFws4#6aw-XwzSfB;W>s)`O7(=8^fLom@#boI-kS9OxZE8zG}=DSba6xpj4YR>L9Az zL5L)Z>UucEMrVGg>IW%e3b%x9*n@F!Pel$gpCku3h$7MqIJ2uPr(fKYAb?h<%1 zdyub5e+YTd6#N({LQ^p77Z^Q`E1dO9G7@6KS-(i_{v6S)Uz3~&5zYD~Ni@O?wX9#b zRpN$P;~ibEugayugT>z$@6ntFPiEv<44J-=c?+Ge(3y&kYTR;KyZM+alb>cf8(CU7 zi0t|D>21LMfslsj2SRFYADBD?HlM!e$)>@PqX!NjE37=A$9Q0y)GEZmUP~o2$(^%I; z!!aW(&^4>)Xw+KTs!H$o=%JR2s($KVg2GcY4ZT zr7Dx)G*YTAKE93+vRMRlVmvg+`G|NHKz}B>la40f zJGm~6${}vTk{HA&A{jzV;*vqcBu>y{#Ml^|z#<002`FL^Y?FxVQ3}fZ!5|hG#AJ;9 z^cZ5ac#*^(7UFFVaXqkS5Qv3ns7+@cZ5a9$DYvx*dGA)3&TZjmEj3^ZUEoTC56cos z7-AHW$RQ?CI*K@dD$(jCP9+)$Zg8mr?l%9nX~KEz0GkDy0}W9Yu7L+^Eb>X&O*j+) zAg?@3mMmedJQQUQL08GoSj44lLQu^G!T6VnDU%s*z%*R3=tZkARIJx9sKme)Oobyc zxD@US1vn`RYyqSwuz`%CFuD^0VWBt+RFdJ*OR0E%F0tw9p8u0})DrSx{0#y6CzF}%nl zzzWgmfco(O6yzcFtIJeCCz=}JU_jKfX?-lF{0YGo&M&UeQDmRKhC|&pF@g-Z!T=7v zF3@}^3NJ(n8~PDx7l-^7TlZP5?EL7lD}Geq6={zt(3q456;SXO@uET#WWJ^l0+Cee zq``ekfzC+Ow-o5q!FWi4&qu^}6hff?ib4oXdP4z*BZU-%oce-780?&AxJNa{NbBr5YM23aEcQ3e{9@h}6A&3v9gmdJmoK^1aM@y8Ez zDc2Y~d!PzsKj@&zc!v1zQ-wTJ?AK{Bd9OZ*0w47JgC;LO1z|`hJqv+jwtg7GlilvI z2vczT*CSlvwA`{9WlN^#H_b4TPI-EQ#%=NZgf5l+7=uVX%1T&ty;IYh2HN1Qw+JE~3$0WRd zL88(hz+jPV*6nSax-VeRI8~9Kuu)b;^!-#EqbTuo#1#_zB@7;ml;tDe{G_+>8b%ED z-@*ui&6X?QNv$o!V<*)HY-<>vMtQTkwBnkrTP^lTi48ntFJ84DCA2gsd^J%_O_2#| z30KrrD^5+KjGOYGk1?C!Q{u!jJcGL}Hf z#DMo9Xa`A|$!Z2MwXs+YiEIHVvty zoF`&(n}?J{d^AS3*2Hr~^932%maf8jaz+rgz7|)&A4_}}B*|b<;0Bx1s-kWgC;ub} z>(!GDQkIc+&g7Y?N}EQ}Oy4ycrIU=N<`v2#!{L<$W}=Q^!l|7a zlEoF6KEU9aQF<|O>OoW!e`~zyBIme{W@_zi08y!mWGb37+{Q5l@0(H?{vF}t=$K{6itiUpEq@WFuA; z3Ieh!L4D{ZprBzY&=(v_wVYWdve&_-EF)&?GQAGvIRVE|Eoc5L*?r+svXPvQ)ba_< z*9a1Fr}hr=8wI*WEJ_@A$c-1A^bjqp>E1mMV5*jz0pk@#D^bOTpzL{3Hwb8|R>DAp zsRKH_sN2S4MU1NFiXfh)NR;iFEf%NKS^&P6OT3C@IRKanQLT-a6ayMx)2s!Aa^|dj zrND`xVG6fNQr*l2~z*Ms(c#G?98@Vq2FfQg;)>WZ(SMuzqTCTmLw$?ksT(qnz)p#a**b#~@0(M$Ix6 zWW|<6VbE#=LxN%}Z}8A+3oqk^hJu07N;?5Uf{An|U-#!RPTDmD#1&&TUOLH8zdzKC z$eS=&f|m)rcj(dqmymF4u87Jp*4$T?oJU9EDhC0k3Rtvqo)?N@3#S#esz|0H(rQJ0F3F5xe645&i14bT z_k$o>`cP$^SCeexnIa|LirPqsr_B+#N)^R&njy%s=|#14tRpKAS-ofh!&obHLSr+ zmQ3DhH!yjP(uZQ~Gsyg2FL#0#&!IXU50P3kpqO8)Js?@JZ>zY!YPZ&%NlF3;ShGMy znK{kPYvXt+IENFdjA}sl8I+^1?Bc83xymPL$OTwKRY+Au4a+W%D9tN3VGql7843yc zqA+45Lr4sniF7xn+C*{j2K6Q@l#yJ;{^&$RSJyr~6XGVUkB7RIiEhWk{? zlL+!W5zLEh1`2T#Cf83ksH-SBjHEv!hmDYJ0#HGGQ?0OKlF#CxV zYyuDibrY?SY$7rQbqkG*Y`{4CLuHg4M9!d*g+@sEHeM#6kWi-uUXfCjsibABr4xFl zDmksOD!f9g=}Ib|c}g%$v5$1L1SF=RWt_NGsYUz43gqTRCuCnO%~V8 zBAlXSFbZm>2w>4N21SJ-T|+J^qmn4j%~}vf*|MsUW;|dE)2-JkY39|{aa%)}9_i>t zWzwW5B$;+fMb$_$ZkLIsz)fqwN7=3@Ep#h70#fN;6a`_Jqhv>AphIF(f90|swJyw7 zOiT*UA2ZTvwGtB{JjjfMpk~G|vMZ&nmie2uND8S6Edfy^mHHoLgjQ-HC6#unstBtA zI%HB=8Bi2#)9D_Zsbwdk;V1osL``#KHP#@I6f&aFDVZ5bPF_ke*AK)U_$sEMO3G?w zq^#ogk3dHByBXF}^}MlUf-x^^nu4^rCIBzBRW>Rr&!AE#yMnAVRz)bLHcT}VigHWH zG_)%bt}fv+Wh+clUPUzPueiw&Vv-hp&FuyzVKi!E;~~T+ECd@{5G3Boi@qE!qB*rs zO+~pm`)D5#5hj@s->J+igNV?*1E8nUjkglDawPnr7Yi%(#l>=Swyb%uFp|HNRKF&L zLo8GZOg0>5-oQjdC^rP6&;|25=9N#FWVKKa*E2)1bx~T&n^<@E4iqj|I@`}7pu)t} z)Fx2HA2souzX2j>7`@Eh1j93g(s`g(3_gR2zLa)`4b`UW^;HQPsBM84ryA?@?6P7CvYTL%}KPvCWtW1yqh36w*;_P%01zQI6X+eiqm) z+~eFr0w9cuU_TVfF?}$)-KF9xgKM|edz8Dh^1*TqgboJjEICj$#D>J-ZXlv;WmGP3 zQRIlaPm*<>yiaWQ3b;&(1rvBhqPc2f#e!^WurD*((2ov*BLHmFxGbZyLnJE@Mr<@^ z(?CddECu`x+BzG}KwiR0+a?el-i3lXiYcW}Cuk%Z6KF>?A`pyd1o<6|H6+H>pHxXB z)O?BYBSzKK9>rW}6db9eY6#^nz;3{>h#LU*A7U7(=ol#j0>jNF9!4ZvxJw(vM`vZw zj&Kza(4K0>K{XErB}xD%VqC6VFL4x$?PJv2#*QtjW%m=bRMP+rK%f zCmF$Cn|6ZL3>u{=b%CtE6FWDdCxgyXxGsxwCwE)naw`sOF0JCg`Zg-c2)tnmBgg<4 zuZ1EZc-0dXgLY*TYqJZOFj~G#X-M$07j8L{qC?jfNokiC5>Z)!TZSl{cT3><9}VvJ zheA+r&ESf^zX169^6Wlc4s31y!e&!QcFv5Qqe~e_-CxCxlmaKoGizgMK8wS;M2kT^Sxl zCf?v?ix7GmdXIP+1q9$*C8W^c-4JBDx#)qu5W25{lY}=gK#XvU0>r}JRlDy%K2mpv z1L)NR5DOX^Te#)Hs1CDP4_r%!61-XleHn7)arw`I{^mHF{9tNXge%?7!1uZ>nO6+ z7z6QaQe4j#5Aeb`xEBt?^~1GHyV?5F!rLuD7LO0J;%^mCsM7HE*eMNf4wKSgJV>&0 zpDa^?JloEfBdb#8MJt_})TPkbM=r)rF`~ML&n1f0i$=)D2DwB$2gu{#u|8Do#1nc@ zLOp5c3DsxAJSpfdm?zjA8J?PUqzuZ4$HUO~QqFmyx{8i&;ZJIxy>eyS^HZ)MJpYtr zl@*150tppdJXeIuTsQr*LFBAtk#gAyGw%2OWnZ{hp1lOblL zV1S`qU6y<$48L^rqZ-Yv>H(m5+9UwiwVSMTZO zZs*nNau4Ue^Xy{P&MLJZxum zzVm%&=a<#%z4GzXz5P3#-QUjF2WLmGAK!m?^zdN$;MKi@2WPJyA3S>f=-$EWZ;zI* zUY$SwZdqUcPnO+(xg#aNsmid-!g(|462;D!H}#Hgy#%oHedoWpRHw7ExLB@lX3KZi z<=(I+RoUB|tyk5CO_}y?zp}sSTwiTAt5+Ax&iUeI(K%mkZq~O|ig$OVd{wq?%I@i` z{0+az5*;lYK)uYx;NA7&>_$tc7G9pcy@4aQ;FN+{22#y$%pUH-f6Fx&82Z2Ly?b+8HRbcBTI@XW#Vkje)gwuE;xN} z9NL<-y`#TGpu2&COQX?f{BV19QF_^eJYjAc4XZY*(x}oDF6wZzx;ZbpGOD!Be&>Xb z=5i@j$MSml+wwY8`PNXO>*YEOhl}O;z2et?{d0ePd0uGW{dN7N^4HWNt3^7TwT##^ zTQ~2oiotZeI=#MJU%t7yH@d3U?O+bCS8sp0S>F#^rNXndzJC?=I%mu4_5JGGYaP69 znrLfrwE|6Y_~7v2{)0#R4-WRPu9x9OUO-x`VBs@PFE36PH#_iaVzJx1d)xP$Do&QC zw_)tY`fcxd-210z``dfBrA93u2yd~X?Ly74bzbceSnJ0U_iGZQQnt>PSIdjD_2>dC zv#p=5D^sd}wzJ)QW^G`t@1GUj8f^6mzKiiQjVh@S! zy^hlCLD3q$R_ly%_69k>Ev{F=G+6I!&+FOWKidw?U)Q`@Q?{+Za1j^<^ z*Zi$_i`9i@T5SDkUD(1w@GmzvSL<)@-!D_{y<1!?-WEHmQj^^~y?j^Yt?wT`IQXWV z1fVzTLhk+N`tsu6u#VX}UtGMs#cJ*F-UC9!70|)G2aIa)w&{_EtUV zk*0_oOf_!(Myq4#I$YIy1WJ{Sw&D1;SOR%P%MVShCRctn@qJX(`acdI9Dcq3;A>HZ z!B!H-Vx8!I?Cf^_tK6lsiq z@HB}Bo=mgxbUy7L=W`q&Z@wI#zsQHv`SjIEK3}(dH-0wB$Ma!!OgX(rdl*-)q45v>gN4Ucbxb7)5&}m zD$*T{X1)0&AHV2#^U3^dcd!0}2hG1Whj}AjYmTOM#ilTyL>&!sH2Cx^!1me<+!^&+@pZZ6Nt7?7RdwA!V#tBZ?+*@WdkO>8@ z=d5pkuEt2=4emVH>l{AZ-RdJjSn zc+?+Hrt@qzeVz}e{ccuhsiUkr9gU3=px&ku8?|i+z;{OkDdT*QP4nJ7p-cFk8d2WK zXdDDq1K(*v@g`1!*cbVDV$TBo_K6^Vl6ObLUYqV=<_r}XtrS-cQ5r|x=lOA#Tq}e>pvX$E7Xn3Kt3)=ilQU#?FtaA#NC&K@7< z!>P_%1JYB*(aT}380G*UNbDeeLqe|$YZ9zk3q+y!e&n$-oJ_M}S06O=-663V=Gtc| z8bsSi5H0erorJAPjulOEJnHq2`ggB_?tTj*++WvRLGq#m@>|RS!Gq9+vo_=^6>P}d3PF@8Gm^Qq0`<8!{Y3VHZMB^MLiF) z$#gy#Wr=%LfKt(V--YljHrQ)H?2GpMD-4sd$({;fYDi{ZsQ}Fy0Q?O@f?bCitwVIj zyDbP&JT&z%aMi=WID@DmL1bUbbf!A?8|V8wbGF>z!L`onxaoE<;aHUbX*i6g%IJR4`-X+EBxj3#~S#7)3Y@nnw%&e&^ESBx_} zvx^&u7FEKaf83w?i-G`sV6PDp!IrMYU|fD-v*iGY{>?N>8h~yEY@Cc(9+VDRk~s*Zs61TaBJ|Rn0_B< z=Y1rj?!zrO?O?FvH;xA*>Yd80dtNC*-sW~)#M6^S^t<`fd~AJx#NLwy^j;0K<9^o^ zP~!B-{Lf!K9osz!A^k+7c{Z8mxI<5VX2U zV9h8Egiwq!9URTa`B6U3huzRL-O*rnJoIM10AVQBxRjgEpXI}RTtu)MLS^7XEsnL9 z9~Gu_abL!tog!vpl5AH4322K+f}J*|D2>Xz98U6arRRs*nHfZOR5ZjZ-J3%(AQh9R zKb?pDp4r8Bzu^D~l&Xh3^IhbbUrMhxP)qQQ&6>n1K|D*W?FscT5rS#n;XaFEb4nh7 z*>p4qn%5p3A7D~{SX>I4Cm+om4~oID#!Hef-x&X=1;r>{=3$z*3$aYZ0`rGej{oD8y8 zj*JN4s~-E={59CGHUVtz0(ey#`^T9!;biz=DVA+EnTC_l;j?^Rk7!*a038-&J2$8ED5x${vCP zNNbv@T+~d}RFi1BiQrMI25hKp>?;ZY3VUBsl6?95iXS$;`S(N1tAA-|C~RCaFccy-1yh8t zMi5ej3KZH1!KiDx<_BNZ{Ge-^vi|mc#Inil5(JH}e2_SaN-!L44nrIrnKQuX7`z{* zLfAV3o9Qz2>_GciTJl1{CYlVQ7%AT~?`f#{K*1Q-Ro{>JuF137@~#=Wr!x?`|| zM-~JL(TKJ`0X@lJib<_ac*4OHH0l2(Ns!XDjUcCc(GwB+NsJjPTR$lwo{1@re)jx> zb_z3}bhF`5+k82%MM$odeB8~4)9hJZOP(K%N5}JS)_ra@6ns=dt?SEie>%+-H;bR!`A=_krG9LA2U9*ee+Zmde@_57*Q$4kz zNtvDW^oRlaFo!0@jL>4wc&Jqwh6^9282IXk+FgEaw^&Y!6VdG_NZ>17z_;pWpO;;GCg4W+(|l3aq@Oxmj| z$t8G=#2)()9slELaa|;7-NUc{*y4)qjk^|0?*-{A^GSa&D6W47w`Mk&Po|@>dQr!F zZz!dhaeh3S=E>!-2aEJF0xDQgI`irCd_K&lFGpj=Pb`hyY)%uzHP_*36T zS~t7!gIycI_p!&lR2k-#Ed2o@>5QTuE;ju*&Bw!RFb@~&CSH3bVu}jqml|Ry+vy8{ zqaPq{SASGV48!!Vn|z|XR;w>r$>By7WMUN-miG!3lvhoQ_pZSQES4gWx)_sM`D{Xdil2^ASLve%L1cu~~c{#?c>9_!o znW_Gt!pyFA#j+^r9WiOed)^=P=0Rvb>|L|I>C=S|kZHah$9EB)7LyNno;zH+@(s)h znwLFsCL3SbaUO!H{*w3RPOY>z(~{&SRG7cFCi?T>$xt!TElnc4(xz>N+juhK>uz#j zZE#sS!z#W6r%LE%>dCqMY@8IFQJkhd&xXB0!fx6)Q7hb_&R9=4TPveh6P?oTDI1pN zdUy>dcOfao)9s$yK}l(tcg4y1i^Bxm^B0GAeFPVpJ6Ofq0UW~rz{g58>rV%-MX(SA zmmN>zBG-f0yBxWC^=`SoS-iXIeAl_XSp6OjfadE$ORVSMOsJ@dz+MhzUe+Nl3wZxI z?L$mk+9mxfk@nGRA5EHbePwYqDwZ>T{W=+|n=?OtosK2Vxu3jNLA*KfH>7L9?vE26 z(1C!rdIH12Ya0(-U?Bql0n!WP;uxT?_yXUf#17KRO#m4oy>PGiT<)X;G9W@R zm)EO5Ru^yk7dOkdrFE%JlY=MHtY;A7Xuj=<4;7$k24Wo)ZV5_X&>$A#xTkv|;U}bj zyNdp8CQz@9h897;Ev;LW52H~S-k8PRquf7w(l%g8DE@rhQBDX|fENW}~>8R7zAha;1t&wQpNn1vQ2_9`3 z5hhNwWk5KP(4zIAVLy8_rY8Cf^zebJhYw#{;LDbcOtF@e^)$s$PFB$%#>E=!7!BDP z-VprQ8qdH1V~t(`+SnSi48GX1ap`3+%fu}NuS0;t==$yAV)aMql`B@2%iAl}=Cz=V zQzpe{X`mc$JavNAFVCILZ5SC1*kV5x*&)iWwVa5MzTV`5@V(yjk^pz}!~aQ3b*^H=sJ!t-KLcFl~MRQ9<(=xQ`yccClt{ z?-53p6h%3rynwF2Sp^T=PX%QWi(KO3m1Oa6<&18yDpN!_4*DU}&E$!%lcv{Lb z0kG3jpe`<_rBG84I4vdX<7`?=*9X+J^soz@X<17yM5d*jlfW=7m7RciX=?En(3YlR zH<2q%)$SuzT5DpdXgpaBQlKdd*^BA8lBUcfM<#`fG~I08$5IqXQ<(R)4BXM&rFm6j zn2n}1w{C|2;?Nx3jz{6p9MakK=`X9_>csBl<+(T24-ebOJ3n*fJ#1IM6m4?&s9hbC zWPa7Ip1#sL{JLE&6C^%vSI2yDeg3}CY9U-~d9gUZd2dL6(yqQOr5E;w0tcF8K7KA1 zBN&|#sguzFJ6!eTg7Kr$C`Y6zyV`a}S{sWj+5Bo{Yqc<}bRRI8ld3m`%rwusB2xzf zRl3Fy1f}#%AAmsV+cy+%(zk2OjW^s2K^RGMS1JNWnmbb$A<~RWFu)(p2n8G8QI1Y9 zSdB>#wq6FO`jOO55YQKW`=EhX^w)lZsOT^58=Jrw64CT2Wg>HlbZ9bi6Ac0w`m1fT zJ!ol@3mAm*`bgVe(>4#uK=99!9@0@@8^7Wzayw269OEu5xI~N9k^j2Ku1L! zLPpcnr@i+0k#yoO=6l- z?4E~dIg#5XrlnM@T4I2ZXCxH^q{h!sV;X>ER2Eg}>=(=HBBZ5_ZB$%%@ob}-=o7My zB8Zz|*F?NF!>n<@*(5W^!d+|D^&;HMg;ld=eff#F)TBt*^1HR-U26(Lo>}G;hc~l4 zQ4*4w<&UC}WtQp0@yRUH2||%sW)p)Qvka&5j&4|7txGA5;-rvdmfb}0$4sk9KpQhn zClOf8G@wKTG1Gz)p~6i2NyG#*ttSBfWtvS2(uHX|F+dB`bdu03ObbfFATxbCKH8XR zgh)7I<^ha_7-kwE1|pbgfJl&ErX3=Idzlu90OMs^A_8KUX^BYST&6K1!El-Oh>GQ7 zS|$o$k7<+mxICtXk^s0Pn=5HRIsz{l7aSx<;2}dpMKTlCA=2vtUYWo|dR_!26WB=q ztGHtVD;We9teC(}hJ%S1Ca{y?U}1p?++;8qFkb>Q84VVMm%vTNg@Mi`*c?QEXjnu7 zCmBFK=lYxm~r5M?+7BOt&oDK zBZwhG6~m?o^mK4qkUD~?ONOTbmLo8e5$Yk~2oi`2OhLF2r05z^3)^ePoq{MM@Q{&a zUsxgos={Rv2+6R)cq;-u86Oh*i@-%ji2?B<>~P2!5%F6DHo+1~u^k_iF#$1H1ZvXv z2yjIpCkjUbR}r{K*PFhp$E53%99WOZFi7xXJr;J7&Ib4~83wLD>j|}fm+Q;h>(gcT z@?w2+y;y0X7o_W*6aOdF1YTX7y;z*zYLTy`%d@u@?8cKv%4M1WwDM4Ndfi@xny%Jw zZvXh>{dYIlw@c2~9qe^>&K5VJkIt7nVdzAa`)%!p*(*I?{j+b&T2;RzS^-IZf3=J$ zwO=46)KCdAfy0g{S=HQ*xhg(Iq|gy4B1wb-X}+P}9OIN~0}Sd0aXXsNi`X3GixK{Y z{|$h~!qJFC5HKSq>Yx~n@OnUGr>EiMyL5ZMSuN`(+WiT8|2~qd)VNxO$5sn)o+|0i zfq7ygB9%N~b()LGQ>V266T1nm)eRH6;=dUPruz9%N){*ydiF_DuBZZ4Rf zh}?s760m!k)HcXHLUvmJVKD|-Vjp687M+Lh1JgIa_tB|7U$me0YdhpkT;F3XNn99W zkVv!QU7k1VM!Y{wQVP?MQayeDNv$^|7%6_c7K&82#Akp)6n-=5;$8QcsE{)oA0%rf z;3M9cm;^o4ewYg)5=VPHwrotia(Xs4TjQjPX;tVu{*8^PY7asZ5KXfiVo9HzVMY$7 zW3$!$PY$K4M*RG-lt8k^Dcpmol1vUdsbZqWC2ec#G@FMO)ud{C`bND>_4uUydY!H# zD7ByXHDBUvFA<91)OMFTykji`_u}s&UJ0#=c+*OdeNaXd9F4^>DF!Cbm%5g6B&jmx z(*lu#6G%ais*)fTi*YLwAO+jrRcYuWl!-?3Adei5k8^5zHP|0zYycf)kl9F5n<3C>l$E0GRv0ajeghqEpIt&`$4XG$-F;SqTVnMQp zfmWy89ROOH0%@fCjdhv}d=?XvQO{Ur8|X7Be**|KgDe>ljb-|vjK@|Bw|pOM)5)z6mXI&U_4Qan$)&5 z6>(w(=YtaoLK0c;s2qe@M3+5Ej8TMCcZJ|`Frj-?Dg?-5$kJNh1gZBQD`8tNb#+>wYBipF}3Vxv1hH1s1C5rt>MCfI|` z;+_gQ$ZV1}fP*L_O@OnzY6Urna}q^(Tf!EwgD~A-SCDZ)vcar?hk<14yLD7Al4S@{ zLAOxGhky@?1cpHAI!2k~j)8vx5dI5*P@U$k3p^Qnko%-R1bNUT{1{M#CSj{DFf@)! z-0DkO6vT*IeUYmE9MV=_lUxWPZS^HdXoM};T7BV0g&S;@b#!%o8C-??i@z`4qdg7Y z%*eYKvV9@@7P?`fI~5(Oal>ux`eS+~?`AvOU}@nba^}mow-N3Sq*R!GAf?3Z1Dj`n z&8Is(**3Vr(F4K93RWKAV|aKd`kQ0kY1yQG1?)Q5EC`WHW+P>nvx#iCV@%#2w%rT1+4!*lhb9%#(bKM&h^Sib{6tLb-BnOr z{i6PP+^um*aCZn6+}+(hxF$ewcXxMp3GVLh65QQgr}OT!_c>?&Gc|W}m79htsDh?y z^=hh~@9#60d`OZzAdH1nFDvCID1sAA)(>FV$^H&62+1#ka|V!C$z`)E7IczQR!-?b z?J@Ni*AI!N{~mp6+@_p*U{I(kAptZO-opH(BBajOj0$GB7an0>emhMoL8+Ghf|V7L zoG_{!9-Xj{cDAB7LaKzbgY_dqFX(b?uEl)PbLd3@EYsbcdI7c4I zq;C)4SRw?eU?s9e0Q+JB3PcwQD~M>CeX#XmyASj)B~pPq8*``@cd%+=jTMAbKd|GS zG!r2O0j>@WbnK8~143gG6b&LK-v%+1u@P<;h4}hn*0eNHmh~2KMgFq(?Ps|OT$cGj0Wqf5{6vCC<%ld1p_7Axg9wnGV)#p zNOH_T15{r76foNtbszsM6molMX#rB3SRLW*OsbB%-V~WLm z1^eK#I#L9~_!tC1>FZdZV2RAGK@_93T?ksk=yVVfgjj3R?e7V`EFV3Dn2f>0xNZ-O zeM2rW{(Q8%zd8E$de*^w)Q19B9S#(Va;n6eE6AqY8had8G4U-+KpW(t)o>rHrDGt3 z!kJO+gC!D?L{>d%6mH0D$f!|P%@jqNe&09Bpl#QXEYWg&Dn|L1gUsDCK%5r8<}U;b zvYSve91mKaP?UR2G^KKl6E=__gQEN!?4K}z{0pyliCsS~jV7c}zdHt0Lb5uz(v~!W zHr!+YF$a}oIjFdTAtZC?%%KDf1bn|rc07Wv%n(&-R9yHapgVFV-ydiR1RxI|wYE^e-D!Q?25yO23{ zZx}b2I+5n*X#6N|U+#eWmT~GJ}Tkd_>LOHW^4Zb#ISs{qqLuXIi)R&e3tmA55PUp8(UBb@Wdj zU~GNa;VWA|YzYsg@p}*pJ$CLVwz%pj5MT)X12E`@1>rc`j2_?^hu$Nz77JHWzCZfN z?!g(=KvOH6K!0Yzl|%X9O&CJ!?~u(ie>nCNzZ96{GrPT3LVZZUwTSr|2CttcH>+s-Q$R=(iR(WA1HECQP>0Juc|hE8X8-`L zj6}^dR#VcfM>Z6ENs}>L)TOnh`nohvi|#>wIKp{Iw}ZMfXKEySvn<5eA|za%riovt z{(6phL|dwI-V7aKCUWPU3ic00@%Djug$aA}*F1Eda{xBYaWFJx(~WTY|?v!Xu8jCU;-3;-{2x zH#IbtO@}eD)S^a{^J7B@EuA8aAH-upf@cL4`u>2D^`)AyqU|4l!N%WM8^M)C1amqX z2Dq4|3jHKI3h8Tvqai7iJzwB_GFZz0A(?V@1@srb5`6X70Qw8F-z~)H_P7DFPOjo2 zEKvhPGo|hmW*vkiqca-Gf9e41vg<8!U>#saqODzXrbeTk;=O7Wy^qvN^NaYd-(05> z^|#K#snwfJsTmqXq3W+3wt(D>4w||gS=3ZbHSs8jL7=}7%p3$LqGlBigJ$&b?ncWq zV?wzj{1vjXvg#0HscrJ5;hD{QNZFVfa~!+!2HS73C_eCkq>Y#M!8D(L?6#D7M+Blx z`(_@xnV1tEZNq|Y55axP&ikD-1Tlyh)%X6ykT~Hr2W3PL3$?_UXaOY@f|Oy;P+djmwZD@tpbqF$(l8NK_K6UJTt9$$KsRg-5uDEf*9@+v zP_}>J#n3m}#7CH_3s^eX6iWX_h7mJL<9%FjJyUwh;3##`XiV*XupEjJWmQa%SbeE1 z7j8N@GX`FXrV=cjLN*aAd2fnLLj9uPAlh>jVPGF%RI_#IZv+$=w!C|-e?keR&D|!C z()j207NYw&w}G+vpU3+O>sED|3ZQQPQzEI!Jhp=IbzXWDF- zln!ekW;a;wiOhZt=qiYhA%_1N&<1`4sB7%d!TQ?}$&X4N@Ke+GUB3~6O<2f@fBUZB zZBigFP9_Zo{!1eT3pYqv2)0k7j3RFjOhw&Pqfq)h)DhiJ{0xruw{kXyDJGc}DG=nrc0(Qk18b4{UIQzAu8-A}ut1n11ak+nzEb80|q65)25kldnH5kJ> zCo6xNEpo6XrU2}oO@k_kW7Kvg$Pa1*hi5H3%P&S?nlyB|zw(0{>l+0x;6<|+&41w~ zqFrDUXhQQWJgbGndNnD-&hD6fP)82HTa32{jA&{C zyp1?EmwzTk3JItYBrp-kz=AVEl%@HOkrFND^ttgcHD~Yj%{3YB9 z5v8({%_%a9d7#hRiO0hS2ckeAx*bhe5tE)}+nYi>tS(ki$ZU&BrT3Gzao28!F(7Wy z%tL&jMPT6K&Vs`33b*w4RdR_8INXipIJ7X$aRbe8}ur8)sCb zFIu{|xiV0AfS(GbN&s%641P>1vW+hfZPYh$(z!5S01bwqvADF~ z`G9&Et*ov<`!E7gThs0k!W0#QC#mCh7%?;Kx@3egjD?VG#NQ~DB&F0NWDi5A59@|YH!(Do z)C{lslpuQ1pMu3`_?GN;21&u?Ll>92~axs~J{$+U_+c58WbLktrz!5HNMFCmgKMR-NUlp^Y|O~feya*Rpu z9{n)c#!YGZRun|f83yrP7B$sgXrJO}6v&L&keEYbwa_Cz6uHf?bT}176ZjP7up$D` z2(zDGfDps=Ks;<<|r#L#9Hue>f$VB-X-X>^(qG!Im2m46 zRlATjKw(5z_{VE#5CRj$@R21xJ0qNtA|5m{6JIyL>XSgUdl7vLm!|*zTuW-~cY7x@ z0wMrg3QC94vYIHWKsz|UoJhnXI@u4uKM(`$64t@!-O;Z;zkrn2g8XY%s&qqvf-XZN z#v5ErT%~5h=m7fUixeQl5EGDx|NOAt3tx$ z6+1taOkPrRnK8ByWk2}5@go#Hz4w~;H-H?76(5Vaakh~-PBgYH+ZBtThF|NPguA0E<{6YWBhGq%LLU7l(mPsVPQ(hjJDKv-7+FK<-F3$L@s3re*Pj+wGSTV zMl1K<>jgJ^IR%oq#14p(Ey8ImCS#V{){;{A?&m6}Yz5?z#s?!m(olh=fVHF?s;^rb zb+;jO#7Mj{;q1@c?`SMIEQ#BW8p>Q6*8M<=p{AuS6m9f(aWOHFVgUYYqyK{r9nf8t zS&UOhla`#O)8)T>tt08@+t_Y58pHCrr9oViOIuvn`VYn6P?^|u$CtW#g6N-bmfB78 zlQBd$Cl7-pPw-dDFb^B4PJ5(@QVk$y1G%;&nb6q-{`AVQepprG`#+%o-TF^ohjCW& zXxs}5fpbVH>fD5GTTdAnW8dF=)#t_VTM3_|{m-|uqx#q_omJatdTWOU@K&t=ilz!~ zEJ+IdU>z!gxQOeB0=Z>j_{Bj}9*EkcZ9bsi{k6~uu`K>b3`hA^p=iKPAR3+==f~=` zF-zcbCG_*mRu>j~>*b5VE{~yb_pOSo3vHNZ0KfBNno3e@i2!E_vv^*7c8#4ehqV9J zI%9_Pi*u>?EdNq{a`{Zqr5Tf-Dqa9n-i6j296YpN4v$HSh<1bw@w!atyA_i+)_!-b zU2-M#BJ=t2p`27z6odvZl1abEym0Z%E$3-`p;~u73l2jp?RlJvWVY$x(|42Ukv8*! zVu=j6e%|lQnEk;6xRFxmL0IF_y-;68(4dEI^wkM)oecf)^W{m-xO17=#`1jkeQ~0)uki6}Q`_)J1ZD`O4W6O;ST-)^}I~puwQLfbI!_YSBbq2~*#Ui|?NZ zK{g?l$3)SHXPJla(3CC?U~*8%l@blU&h89&H;o}ODJ1k3^N}Yrr@X{2>qZSjK}a4E zq&}3C!Q*F&^mm3zB}qf|t;qKWbZIxNkp{h+rOyRDspQJLIizY8wRdVJ+PY;j0Q-PW zZHC28?aUyMP(SF84Lyean~llJgR-!j`TplW zmkWwM&aLE3)@*oF(DP4z|GdC72zQX}-M2Jtyt#36ZTkJ>;#lKnx$$(oW}~Fo4GaW6 z#-Y7yk5B7{&etn#={NT7+I6-27CzqiK3_jX@nkmCbN+sAsJ)v#9+!1~buj%|Rr~g` zeD{8|m1c|2%j@3O>3)0T_a;`v=T-Z$J01u9V%x!~{r-Bh%&x~UI{GnO*ILz>zr84e z7f7A1l13kMYUQGod6-D=U17`h(O<%uQPKZ&{cO_W{u5&&khN5B{rT2a<kZ0Pf(tV8az$Hsp0QM%nyesh#UdYT^V_$g zG)1JkneX3gp6{H@F%Qr~$O2-EprbO~$-SbW`>QSo!McK(d3=K4cinZ76qt6K_(c56?>&Z7kF!NUHz zvH$nC&cnEVg2u&BM{Fdl(Hpn^s<-EZ_vh=jsg9SEXQ{oa5)sufhv=8f^{sZHfR<7V z4IkwSlTl(a0&(gT@)(F)v{&y69k0WOvasCixKbbeJ^z8nqsIO_YO~e5iTgI2IZhPJ zsHaq}@-}KqKriJ@LIm~qyGcs9dFKLapVUj>936FUUq@A{SgSIWF#G4AyQxC6a-6)1a!}RO74YLHTMxDCbMC1+9#S2SR;8DUGya`|F*PV>@@5M@`Sl zsPcLz=`bng8C&F-9~&*)01;s=&ag0tfZDNBz|T zLo17=)E_S1!Lx*EpDKen=Qfb70_udNv@f=|_5nY`uDSzOPB4PBvhSHpm8uz&3UW|? z)?vhd8*il!w|ur3RjRThE%wS|W?_S74bQ=$J=O{bbH`F609sBGgVe+2&Hm1LL@j+m zB&jTMAgmK&spGCQ0`N&V69Z|m2erBMv*QWy0=qtbz2;%Xane%@m}lOmuw85Gq^51# znLoPQd%hkYZ(k_@<`Jqe@axl#vlUulWfY(N6XX{hyw91|jeB{~P@fidA$%}zDhUwha0-{xWGC<#klYhk6#TAb&R6*Dp zFF{o*IuFOb=4@+osimc(O;dNHJd_9uYIC7=v^MwX8LMb9z{u4;GW^%xh1%jClgaz< z?bn9KI%f2wW|W47qNHyJmGtz9i&`U|$D&sR*1$HxO48RGnCnz7Y^-Dfc^Vi26uX|N8FuX@BX&!`yH8w6ia`mMVOj~imXpxFG zx?)v2!o0_u1TVHzSx*X0zBX`b>E=lQzCPZ*M<@@aE-YDAt3;`n{F;X3=%C~N+?Kl+ zRHzy^d6W9cOKtH+0Q@t2_4?|y!7Wq;0v*xP`#UwMpxFknfiQel8uhq!BNrojzPt0p$W@qr$(HP_=01h| z?OqOsfMX8DMt0)*il!u!iKTyY#4BA=8+i7}Q+)I*IQO1}ULGdBNbpcu4e|gXa1Fqk%;&tLxH%>jD~<5^`pfmk#I#SV%8F z77Sb3o|E93Z}jxNxvn>!MXBg-z$RflQf{BU)$Ma)!{Ts|3c>m*o2iSjkxglY>xCzD z%g&nZ%jiZGCYEW&^x60|XKRP9|4w7tXf5;kPm1Kl*7$~M4vUpQK*H;RV=`kmKy^qf ziMJ*Y?M~SKarue<74CdMU-b0V@kH)H-16Pg5_t&YIrb2pn!XgBc&J&kM2ZvVLC<*B zo%ayAGwZ=EamhJK>3>udG{gV1qL_;P?~0oMp^doOc@^>+oc+geJIAdQ)l z(Y9 zl|!l$qbFU_xL^?;)SyO%IL$<^R>Cz5079;kX-2^~uADiNa$L;Y^fKc(^|AS^*ONp^ zQ^?7TGBK=!jR3>4_umz#PTUlVCEb??xA#e*|Q=?=ZkSTysSM6G!;JJHud`-m| zb=mW(XkTn%P?6U}>ul55rtqelQfjpf%=p*B3%$QV zL$@ycc1Hb%o`G4N%)K&M7?OjCC&8y0t*?YGFx`PZ>Vc0FE#s zIK_)%;g|WEjjsNX!o5+KpDeRu7XGwF)mg?y^UZ|0Qzg*&5~d=|4jCjrrU>?LwoV^Q z8US{T7oV=y4wgAiWN)rsjaiPgC~Uw?GAZ0x>;`oG>P*wOQgl|ku1ip%-ge&S^w9H* zwSPoJ_d0j3lI3xt%xI$~Osm;Y#P{ZB4&$BgWEQuHk=yd7@9(s+^Nl?FNjT+)H;1S` zNiL?oR)Nv8#9Uph%mFWmlFrtVZ19 z&<_+gB3tMzBd_RvCCoI07&J?s%!&}Jjbl@RJaoCgBGeyCG4)Vfn0*tsg?u+%}i}(q*O?^HcUx+>tlYQ z%De-Sd2~4z5pGt+;7p^ueLcINfUeA;Uw*Z#=w@qSQ;g}2cWUBATy!l+%WkDxf7tdD zvS_|hg2qFeqVn$eSxayZZ5Xg@D|%Xbeh+S>g+FY^H5q)Xq{{9yNqoxcbmeStL+RlN z6TPuw9v^($s(pHB-VP9}o;>@kfhbtlb)w-4Bd*DYFGOhO7}u4mfO}bo{f(0&HR>kM zJsr6<$Gj!4`_%bx+#R$*v)rDFJ&SKN=&31KpVfave^K+3B?BL|^wD-lI3Jft`YGvh zB@`-3LmUK`wRB8#g3DLnZA)?zx&F(S;Qb1-V6_(ZplweYayc(f zWS9Ncp)Z~By0+Pgn|NugAxc2tSp7HJu>moJd}pr*X1`GqH%RS~84^ns4<~O|{(E&3 zI*S}{>Q`N2^yCF+M8nGhyq%A_&8EZhaM)&v7XUlB&1touS^IL$SJAIs%ST%5rDNDP3$T0ZK{>iyXV z+8S(W6>_PAmiBv;_VvV}5`D^Vi{) z4wk(RIl7^a2XNgJlsjveetV9K@o*rrV2`XcG^Xghr$soz&&8{FkMcT=BJ(97EVU%n z0#$}RhFx44yg~cJ3cjIGVI(vvb+!KueJcR{PRr!IXl%@P$d5)6I*MZX)%f0F>f-nv zaxVt6;&|TBW`SphGGT*ISI6zsKyvP$^}LmKAl$JbD|?bfEPT{RBhXY3Up@tz3X&a; zKvO}4mlZ;GNi815d%q)B6!vxI0fW!V_2wcdQSD=9N`9%yM4wXF3a$`FFM=>127|H= z;L0gB%gXmyx(}^08-Le$L6RtAlSF9dzUS8`q3pY5_5*wSa3~#Aba3;H5u;~4az#2R zr>Jmca3)r*gl*awrC;1!OeJgQpi(&Mmb8m<>5jc233mw87-%YpOnvtI%w0|<9xPh- z278D@uOw|@-BYVmm@VI<&)V}JWjUKdh88+{kuS66l}#yg4@2DcH%Df? z6BM;R1sDE7W6I4t++`gr81MxAamdT$H*r_R>?f%@5F1jneer`NmC460tTH2~`9)#~ zQ-ez^L?-^2ZY?quBaGUQjQw3n>vQMVmLzyUuGihu zvy9*DQ@I~S)9CGQi3uzlzr7}{k&2*4&X0bndYT>KI~h{l@Q-sct38^XwpyaGc}O&U z6mtQvbJRY|cq!1ghugnP^973`qifqmT{W4}ospvNwj{mp zN;`ZckPAB@mN>!pyqd;Tv$9>SS9c{*)Jp+Y5d!vaUz%8JyWN>TN6d$DuH(f~^@rc= zOtZ+*2k|JDBmv~ReP>eSvJP$xcs;)2(s*hf1xPJ#xz7;9i|a?`Zgpinv(2J*tb3l zr5aLB5F-DUM9Zf?+LKx4(XGF=Qm+gw*vR8^XQH-08SDPWv$338XV?OXS7NPk2|0zi z7ja{=?ggMtKpY824rzGfw-vY~AX(c*TdUXfXjevJFC|1PtFCTSE6&#Dlm0@$m(U~I zvgR%?lAe$tr~W(^q|`2`N%!k~v`p8$HZHEMg$^eaZ-rYg<=8U5w>@vOFz3XOmYbL=~Uv{ePR6}d| zaU}8vMfxtOjs2%ZL3>;pDSJ-OYlO~p7PMSoXo!tD>ee@1Yns)8IDp=50=T8$=nRhP z)t#P-AiI*>#9ona!Dje2%b5$?DI%)V>_CX-7L?z3_23--A3jkD77JNOx?%c6F!WrR10t2s zRX@M}BPn z#Hu`4%qQ*=`sa()Cm!!kjLU5%ULPGf6Il*CuQegB_WL%XD!Vmejs0(X+P8l+#~}@Q!}M$GR=un1w4Ld# z(rzR!6mZHQWs28k3IyjpHBj&>dl%vaJIXhaQF;jYsR!?5p7%3McrZUVmK|=GfZeT_ znE`Hp&$NghlfOT7&+W@SzlviN8R@R45vmRfKp_ckS z>${|ZniyzlkrWgUREB9-hYZmHu)|hxy*Q8SSYhbG%`HiBoo5mO2EJmzsv-o<8V3c5 zw9bsjY-w^m+#KKdZTIePQSrB^_*+!`Eh_#N6@QD0zeUC0qT+8+@wce>TU7ilD*hG~ ze~XI0MaAEu;%`y$x2X7ARQxR}{uUK~i;BNR#owahZ&C5LsQ6n{{4FZ}78UAaKccicf<(r=b8tGch>YBCunCb_uChILKd zxN&#U&~>9TG6N%2ADldXJkeL#u56>NReZd7aqeCaxN%!sIyT%{o1PTSr)6AzI+{4w zHGO%gJ$b7_CSbsCcllBMvAMO#cfsfS_*nMV&u-hX%;$c+ds?>Fy}VN!6xH~9>bzq; zHdGI*L9w_;qaG1;cp{N~567~ZYU8=#MlZc|c3Cr>p~|*!^rzZZooXKSZiQTxT0cON z(ydi(NbhGQ{o={|TgOF{{* zjwPB3WN+8ENn!IxWcdSn~kg%9R#@vPdF>j_`uaO{{Q0Sl#lr}%^GM%7+ z=6KIVA(5x`8R!?-j-K#e0{>EL*H(@%vahjTq!yWf!~{lY=h8V1kAI5?4paXU z55gnQ1xcV9l`kcYuZANgMN##(#+i zdjBmRST_6-4@QgrOFTgSmv|t3LfpVq>hq6yAmRoT58nSz@!;ftiw8FUH}OFKzr}-g zpm>mn3!!y^Sq4820~A?Ws*QxGI#*Y~b~I;EQ*Z0u{CwN3*i>zyucuXPd{JG>q@ zH`Bh0dRJD!H$P;ZjD~sj!kM19+h5&do;3BkA;SO`MWG+?8B6C|QOYQ2yCYDGTO}2@ zwd$exEl9pI@-*M!RYVp%+NqpuQL3`pt`t7;q#n>7sKO~L1uTZ2qzEg~kEG+TPEcQ9wAiPApN zI~kXwe0F!4jcHWOxZup$;^b=0_;@}M$qv)#M?2x@1pnUZcZoMhn-o)*ap7&Ty05I_ zP$8>&4i-RZhPuR+VzP7OzQQ+gz%jGt4#xYR-F}D76UeJoY}7&TY4Ug1s?ML#Z}KJ| z{+B*yWhh8|qk~oXu52%w88jdE)b?cA9=m+|Ys+p2tJn{3fx5)6xL>vLrTmj@0W6KQfytjsZLKE5hR#~s#!=*rt`}#@ zq@YNP-*h>9*6t408?fxkIy;}&yUc!C+-Iz6u>99%fB$!3om&t@ID;)BwqlV-+Kje#b>8>}j6cG{ zY9|iwOsPQ(hReAc2+nT(IOg7mx#wxp(KT zG4=6`5Juq}Zp|~Ol6heK5f~c25S|mZOC~b)b_Exb{Q;TF-~w43*%a@X%{39WRgM^u z*|Rtb-8@8*2D)&v9PxbA0#{mQLFq{(K~r#$IP*oSBwKAc91k%*Wb}d`_H=S!nUUqt zA)Yk9VbqwZ;9H_<8rX+Y+4!tlx!baK-eRm(T$qB_(+}I+u^f|L$_M4jWt)WMlL_v- zj&wFw^7FamVkMzw_acmhR*}775g)pw^6l*o2^+J$^(;cmRG!bf$E8*4D9U6gc5gQ3d*+3V-vRsUzNAER|w$~`TspGswRTwf6>8Oxvt{f1omv6rFztzTITs-?{p z3ktji)(xux>@stTVX+9S$(`mud;OR_s-43rj<1E#6}XZ8Su{SSNKP4$O8K>5QSg#Y}*9{3pj zn>`@>7kl9JFZN)IFZN(l z>0j(YImUn318;->H}=47XL>kf#Lf76zt^01!tExnoG;l}Y$Q3&ETPJwUE@V!(uA#S zLxtySLMVIK`TZxGW~-bBQc~ihDU}mQ@Cq|Oj8!4F?@kcMBNn4;W?5Tc6fQ5>3kh%8 zZwY>5q@s4=flsf?&MaK!N-7{B#02YdgUfcPNVRbyV2tA8RfWxl9FLR= zifMt~`9~aXG02)DqQ#suvFauHiH0JC)J(?usdqsFcLDRi4*Q%SStlg&n1NNO$Vh})t~a;B)o z$`bflY0V4vy;GGSOkr%!@U5ys0yS*y6sB8PF0Ss^arENpHoDTISN)x3s;%GH_XcCX z9tRb5H%!Yab~AJHQED9~boR?5_a@dy1?f)Yx*OhDg@-N7bSFmjYrH`}K!@zN1)eJO zW1AnX^k6%~#LsK5=DZCZe7=XnV6Ihx%l4g?aFn1A#_tDJnUQDs{!8w;)7)v&H}+nS zR_`8_&Rc*)JvT8`@E3|p*F=0l==g|16d27l(rT0VKypga6r{-gomWbrBVuEgdTz$Z zh41=BuZtMnQhQ|lVDj34m!4Q1F^AbV2Xk;`Gzw0srHNr@QWo&aDA7>n1F_Uc+AWKx z)Fkpv7m4DjY34@gYz#q=g&KD|;e0$tKQeT9Hfy5SbMkb%b;AyXQes{x^NId?jGY*vk8*_fG+cVxeItFCHk*Du6nUvop|Q+VcG5FJUF7xxj6 z;NhM{k~Gom&O3i_sVc8C08K}zQ$M_1V-VX}Z+rFE4iDSsQR^A9_-C!(6$f1Fqfnpe ztm!x1jKTvL)K2?MJw}^|ms)1JF63mPmTAO9g|}7yjP-Hr)zU!Ne)?onN4)Jwr`a(h zRilrxrAhZn9A0YhR*BWoqh>?H|H?FtgTTS71mXtj|Jv#kKN=1@5Jc+YBmTO$agj$9 zC4*V5DVB-)wXDzSl@f7tkhk22n*l+z9E}Mzyi0oWJQM%ITTl41j_j?E`9G%mAT`VA z%(dvcu$Scsbvq>Akh^2DS;v*>Eeb74C0N#ky$e+S$5LN>{--^khYkulof zY%`kA+?mEVam%v;onjdjNpvEhnE=-0U$reNu899cd?|`t5tVDDw z;63huZ{&Qnw|n zufLh_?=0_iRmT4O1@g9jeYn)yk62RiqZQHU+4jQ<=r_^@CS z6uFjVyJG8(bW;M-MM>Us;49cYZ57#M)Ii>j3;PLgBQ9JAQqIENUK3x&erTG6hj9-Y zdlvB0ac9O;f0lL55KQ2js68&zsku~ve~Pwd=EI3{t*u-Zxdb4{NV{-vhnB35P34ct zy1Mp(co+zw8H$?KJaEjFBJ>6zDE8NHAR&1UI^;%~4bcqI zUI2Loi3Nh9VLxQsLsT(_>l!Dm0k29SMd2;=cJ7;0zKYk{NUOUXWb+{4n~%@qf$iH) zwl0BQ@mThLU&=OaO$BF0u@5Ha{J38dVs4qkZ|rU&P_L9t;sO;3I3(!1t;x?^;&)No zL=CH)f+Ih!>YC_d>&~}K-L35V?+0|k3WB_D6Q1(>%vR0Kbw?Svt5*sNf-Nhg5pge1Y(~O7wNUcmZTz0 z=W(wBar0$~MyC|vMl$g|HrhdS8W}6i6Bv0Juq6kDIigjyqcVvE+(;oZ#h=|mc1|D#fnts7Or)?pdfm^E~%r<)JoCe9~S>lctlTDb%WtSxJP< za8iwW@&P$I)Sty4BnQL<~72gh6k2S4f-05@{i%W@+^ zLv@<}dmLJ&PebF$zhKfGag-*1p7?~fXfJ_{>+5jY@7SCs0UI!(YqjQ2Mhgzw-fF|j zA94mJK=48%{+2MgZky)<+4Y97j^MshW8?OyC#jERBXXw|#@2rrntSpyz0MQVKE(Lw zI(1w`)hP#Zx3br;+m9mEl^s)w?`YIx1hQyvE|65%Sq@5M4qxtewLL#%;3g<#XERNE*9i^St<#G!Y~)SLDbgzv6v{$m%^%_srGD_V z1;({T$8R4wO`c`vvy8QF@4ogMfSm*JgH~Q&`0>x>hG!s1TV9(+1*vyMev8EFFutRa zMfNc#-6uMc+U>55+8ea%IzZ5ERkz#|8JhpbF^6p7haI`{oUlGa5HrIGN)lw-NBTWc zA>CQ*dxH4OVSN<&cyq_ECR~hBoKDY-@cHo+f==1N*!@*G-7>=U^hdmzdi{sN5adJt zE-fCPtt^*`oD8$WI-10MHBfy zU=gcBxVo;{z{h$T8bl=(B6P57S5RZLh#4{KS>GMz%q>wgv1b>=SuXSGNO~Zm8p2`F zC{~yWKZ%=7yG~VSwc{wEc|f^7cFp$&Rnc938x<{7A02iDmL?QsW+*#`h)&^wR*1GR zo>md2o8C2|RUp<@5gJf>R?AJd%*o%jF?|<_x(poNoa}3!^KM5l%0~9i5-e^sN%`#C<-R-Uco2!f3kS-$L_L(C%^@{fzqV3ych>%eOv;UvWGVF2@n#311VD^ zj7};#dn?d~@r^}hRBTCJbat#R7zv0Vd}HwSW==I>7Ack!y%|5j^v+Cla^UBt`<4Q- zWKJcIl{BkZOa+sk7<*^WMptkGZlUSA1UXSxPKHH1t2iN{pPV=%%iqRQ?+kAyrBstP zlu&5#5JO$TTBFR8Sq?=t6(4Zg@1QNAv>!tf*CUc@!**dr1(#1X_M!=OZgxJ?R?0Lc zs+6k5-s@#=7HKn>XJ>|VbozXoG;ix@_;7u_nsyu%WWAe_)qIWLP^K5k_SJo^GE#!M z(?U&7&-}CJT4f?EDnVnJQAZQ6m!4TY3VlNx@a*z7_Iy5bwT;9XcsC&*a2aL-KCCc6 z_(bsBu$lMgO4sk*j|%4TBs1|k)?6eN5h96Jp7p=#HL+D&kdwzG=F9ENpxO!3n`Tk;7g-(o#P$mk=4m_5fc$21Fbvfwm_K!GB>%{MIL z*VPR}A_%&8MRI6;x4lv1~{GJ3J!O!8Ds38J)p&bp)zR?)K@ZYX2 zr^axb{8h=(l4-7MK*%%OMBL?4s6n>1n^Kqn7Ho>E0e6~VZenl8HCwsO;Z*pwA8;a# z24^svLLL_^VmcnJNOrb@@}qE19(d=5j5E)C`XMT(wfwKC+!q(#huk-cn5(p(UD z$RM1R5~4iYY+EUX1>4;xG>pB`(UVR{#(;N?C6!gmaqq!!8$1JyO{iB8tv7w-fJEp}`FRY>LrVCF_YR;C!#ARHL@zRao0Xk<{vGP4lXf6_RL@_D5)Mnnori z?C{vNn8FbAsKfT7apDm~&Jb;FNOz=0ppuIiJ8k7cLAC z46O;SJh5-Gxj=}#LE#&zp>N6p8psFpI634|PhAFfc7Qpj#34o@B$+{UO2=mc>oFEV z(oak`AOnI3Ul38i0b?xuq(cm|NHJaQ((uCGSIl$((3;UYVNyH#S?n17CTTa}{%a;W zG|1|~Ith1e{8>Q>kky#+1Qx>2K1t#5NU=aiASZ`71@;8x$Pu(kTA!GQ!8aDxD*r=e zmB}Xo0SsPMdXv1jTNnXtY1pp1x(mXF85<#)!6zjg3cg2blYFO#{{YnrDVL9hme?mQ zyhIqN{!MLJ;)n*zt9SAHDl;RXfp|j@8S}el^ZG(CQz~V;J z#L;L0BtB&@+W99k8}mjpcM?eDgT~mT&NcY(ToR_>ugM7Di&=O6nw_I}duPCt;oMwm zI+}IM>!#pm?j}M$&@8~J=qGe(Cv5A7)MoaUwcwq0hDr9AWk57tC^_407zAb1PS_j0 zUa#I;(@uVq9h@NDb8?x6rA>()jAk%8GIQ5<;WLCW|H-4)q-2ha0lXiA$4#cl8 zprBb4`zLo9h{cy%*bHi8WDzSK!l1{H3i_~Y$lFHROV)!zIr=qy9zPJVLb~pU@#_76 z;y2nd6DEd92B100hl@J%5dNB-wY%17Y2PSMbVNIQ_iy(i7*?^+uIMo;gXEA)a5(7V zW&*@W;#YHy_wSa>YJyx}YWr!ZV~P0Q!|+f~Lpk$sCLnL1q1k^(WL72*NkFn=Ny`bJ zcYlRl;*qhy+r=m1s`#kJ_M@#quHg=w=zZ`x!rOc~RL){pk$b8Cd`(_?!IVf!kH93J zuW>~`ndV5co<&X-U@l&g+3}ITfQK56-l+pGQmVE6g`WtnGsWSm(oI@L;MeUsa^doNS1fG7mO#U^^KdJnleBN9t>=a>}*2 zk9aq1ezus3M099>69#Owuk}SK%Pn98NE=3rAq@_GWo^ejjbdi=j$|IPA}tw@?}f(e zM9fu`4yBZsYnq>fYEutHlagr*q0;e%#o1?7`-ZSpq`(c+eNa0?y-UtNtAkgXA&2fy zLtZFg*Dox3PQ`@g0$(^P{VIqnzHoeQCC0r;XTY@$YU^WMp}2yypB3EF&#c97yY&gf z-7;>+*OyKq$1^=cv8`K52}K2wVcxk1G+3FW111u@P~Bw`o;+S$Zs`ky>pR&PIZ+(w z7YP=!XH*_HZ&pjYc;0VWJXW_3+$_J06l%^SDSpLq%K!Dx=pWQ_3sW5H9!f zm(89dfmBHQu*|#-aE?RrhJ_3lo6^=I-loKNf2G}l>v3bRX?*TURUgi&P8w3~X zu5hB?2T$mjCZV6f2g?GVz=Em**(f7S5FJqv&&7q|M2vVuYo;>@aGzsBgL}SgebhYE zk6W*)r*0Hkyn{>4s>GU*iN$6t4Xc(0l2=(fDdh_)%9^4A-w;p*%`z86$8(*pXKr)^ zy!g7UBhy0Gua4>2;C4{h))m?2s4Y+^F{mYb8=qkaB}rASaGX0eggz63Sb2 zuy|8QJ$6Fc1_Pkofz^WeP`(ux3mWa>@j1d|Yl46aAzn%_gn${xaN;3r@DEbLR|?Ra zmGL#YOXG8a4vIJ4F+cK4A$dS*m#Ch8I0t>xbP|hrun(R`4Cm|DDN((+bQmAD=U7s< z9w@_z4!fd0#F`n-7OjoIik_WiJ=2S+R44|MT@?h4j%Y`Co$9HCP}%vWonKBjL_f*- zCcZc9&-4iFjwLbJlB^NHP#Tz}d#}CseSPoGGxGb?%vxS6=dM{JG2kiu z_XJ<|V*bEyONMWT*p#vOtNu)F6GA7&OuCe6AsQ+mbTOO+3rf4Q{Rtf{oV3G3k3>oH zM(l4lH+3g^b>joEygUo}0BPk;Gg2{5gXi$9GS*ouiD-W&Vq5GKso)6mIGG8luF1d& zMnEzIwj_s@h^DCGu}bi9NL3lzfZD*%AV8gl3@)#X8=Em*^evA%C=b}7f%maGS3E-d zxc9vn%%k-Lf3|M9sSc}M(Ew2TCby^>(-4G>O!5;q^+t5$QIg-NaiCyug z`6Nh5gvb*3Gvz|m$l!RuFNyl!Uw0U(BrU`&H)c_wVXK`Te5mNQ|M+n-1<%3&T;g)+Os8M@&V7h9hc0NZH^ys|_~)EdpSD@%_39 zLZD=IG^L|ub#Phpji`9HsTwNctr!{-V^`RvW)j#94ikNCB8- zVWM?Y5(blMXt&BJX8wU`ll3IIA$Sf(z-v^*Yc5n5)_QIeQk;T(4nr>u(_?xyM?3f* zms)Al>jS=woC7!={mD{73=|30VX6}3sI1}O@~}*1O1k!;VhPy*Ld6Oh&-J$!n*d=C zU?xoH7s^70KVM>->c^-oxOY?_NWBhB+1TQmZ&Z>5B|7AUzG*pGV8SkzNU(fZm`#jF zp_<4U)vrZpjjPlfjEhpjY7J@dU|^;We9xCrih!brQp3_oh$>+5#()|ZbHSlWn5%?m z^}3E{OC00J29O^E@uUXems{hk6S;A)=+x~Kjx(eZB}6JFJLbaN((X@H3%fYbVfc&S z`>lit1dCxv!>u_I?+f$_5`y%}$qj)#zk`TkorU}MU7Gx{wF{#Ie4=`UJ{5%MD@+-3>=R9NewMF$`lKPLb7w0}lF4{h& zaoR4W>6)MJApmVdAFPljnY2yAV3L1l-ih{&V zArePT{~(e;%g!wlTfwt9GToTwFp2Q2Y7N`r&%6Kv;p0400m-*ljkwYX-|P^Zhtoj7 zkJ=*=j;=SXAb%xq9H`OrH>9L*Wm~r=d_b z604dfqM6Ct`g**vRV9-+ONF-Uk3^xC+ZeaIiZQ;YftlMB=8r@fh0DS8u84?l3bMnW z^+V3-+^(Ng;H>f?Tl@VAH45zdC0YO`=`)G9U%VjB>R>jR<TgxAN zZn#&x`riv{TeV;lR7e)nD3O6rL4gWkFW%&2cmP_A2TCp$;D`JvD9HQdM^}PM0peZU zN6%zW1cRtc>tIp>2zd8!5v!=TDgr_8Z6axrV5iLqY!GD1FJ znSU|F2R^|zu`8@VlOo84^EetyR}vY0XjoevOOObJ{SQ!(hnc-e=)M1Dk>^=@_w*zo zMIB~jw$R^B3`Tq4BMTCH$x3%g&Y&7i@x zvVUDf(5Cjwgi+fv_0&vJG0xUHpj)YF@U}S9Ru5NHNy``~aG;Z<_tmzER#MBz&<>N1 z*rP{OkVGHsD-R?X*o9RfF}YfxDa5<-MjIY-s&?ua<7FyH*KsEl!J42*53@wlc2Vf7 zRFBxX2h^g1?(xxO(u_1M8vuRtoW{O!>;;i5_tA%HOnrpN)W^zT9eEl$GMnBSs)Bvg zV2zKCgs_BU9Yq=_b5*hX{7OF&aZPh$XAW$hMg{ZAz(NK}%S*OulmlK!X;puAVRin0X~rT6|a zc$QNmF&sHroX+E4I=`tEyXmO~wRwyJ!*RH6hGNzQ6oENuE7KMcLmNXZjZU`+Q8DNzA)j7@MWa-IbudumU_whq(!j^ zPRX06>dwxAyEud-sKQbXDNS989X@KMoM6k5YF5XEYaGUvy!0j}mjR`ao@Y#KN_F6B&RAdJ#Wa-D*D0GQZ@5)jg0V7Bq&=e=U&OGmjk=GBvPtQ;%{N9% z1u?r~35|HH`-kJ|ZQtRrJ3d8E#)N_%-5z-XZH3RxB^}U)vg-CDn9T52TpuwEyE58l z@N>Q^W*s8^=9OWfpOAuhMVsWHr#28z<0;C)4yN!6hhoy>one=(BQM1+zLB9KZ&-}D zAsSCIebG}z^t&o4j145!t0h;-%5X|xGh4eUUduOdh;()6t@Hj~vJ{K5UM6I&^JB3_v%G{()(E1H7TAVg zBiACBMbrNww^RqMjnCsXdNDR`mn0NaZyWdgv-=Ocnn38OtALd4h9CG%?;X-~xSsLo zT{E=#K>`CK%#RZpYhuC1(g=H0zTZWu2v5`Bk)5Wd_7jT{Xq(94*oUejqbsUVLk3aB zh8;#{I-`Od@B@N;RN2fZ#Q`A;3+IjsO;Nj738#uUfOvzU8aJr9;pPY{(wcz^ALv<$ zsitHtxaYm3-2&gJ_;FfzEdZ0k@qxJ)V3&@8ofxvM>>w%{!T>7~JPwBVM#IAHrxKEo z&^E1#p%Q}8c!M56pTFJ!{f2>dW5kG_wx?%IT};~k~*&0AVtM8ah@WQ zN)+N#8X~f1)sy#{rYo+n^$fK!t{2o{2eIB|q~t|*IhvB#yI5FRQ^YN72Y9~Kur88f zX%{3=Ppp}@mEg?L>LJ+Wl|-O1=uMDnq=7jnBrUWsb_}W|2WafHD8Wh6YXfc@% z?w)^A&{CxN+zT75)u0nJ_=^kVfV8b33C!&Z&H-uN+Ay3D>})7Cd}Ay~(~QE&mAODK^qX+=4z|>D$w?eCpcNO7SsiE$}jNY35S!m=c1%oY6W%bY@8TMn{up= zs6&`f0ww0jNyB1A47<^>5EN@0QA=vgU94=P>8YHGB5MYi0On>xE`((5&x<=lNct&F zPTCSK#bkhFo7osg(RToD>M@%IBNFW;dB%mdfO#0JY-Z1)%NKFH>@}VrVb}14{Uhkm z;hr}IPSTMJS$dl4G}>0359ncaV?lS>6CG?~K|91~-gJXMf@y;6LWJ+kOqql_b?s|# zU`QCE_L(WMYh`!PBI#hL2(#0EP=`rpR7Zr~Fqxlea~St_*9$l3kG1pOru zbzV8Csu0gZ!1PoHi6noNMIF5nk_Lp#f&N&q+>s@{`P1R~z+x^Y9S(-*&2PMLp&?^+ z^hK%{dpvbuAr+8Bg#-6+MFPgy(A0zjX3V_hz|=UKl?dYb>I>gMyy#FGU%3I`@)c4# zHnajF?VoQ9b${AM+k=t(SW2iK#PhRCP^Gj>H4KV8k6OHA516WbSZaXzfuek=MAigm z(!2YPq~v#O5s_Uqt`e+N<7~=Xlpa5W+Z4iK5P!g^8gbT}iMDVyFte}4)gnW|LAYVL z>5iC$rd5gH&8fbW_{aTWgn5JY&7QI(WuBXFL6Vs6L@QHgEsi<~A_yOmXrUlL$B(jx zenuJL1dd>9RurM@_Y7TANMTnAMs%#u@)XC=ktKDCczh|5`~z9{t`Zs_5<_btV$!ub zGze%Q_bd;1Iw-fdL= zsV0agYlDcf$k1lzj!%2xzR!=eUKnQ8qAF^tVdj5V0aLCOaeXtwbV|^3-TPi^#x2WP zPsy*HlUY=@`Qeb@oq%Dm?uIt0Jxil#12Esq=4pec_Yti`_o*i6WPGX#bDwI$mwu2@+ks33ilIKRn3xGz&;Zqnq{>6` zPfZ~BbMX+I_y1}_*r%F+Pf`8v;}3?mFCc(kSS@1X^aUKzx{wZ$zLJ%!vYRE|0mBe#q|`ySM1A)E1HHY zSZ@8GSrCu+!l#-5@u?;t{8JMuK%Z(t$fuf+^-oPO`==)0#MG?$!l}t#z@y}8V~Q{w zo7?ZDz!h>$Y6&_s6La~v)FbwicyCgO?kgCNV2w5$YdZ&p_Ud{(b8!Nwbzx1h;1Lji zh75`v|3w~@ZH+CB;6Q3KjO?cqYLkvc=U5+$#`oQ-BB-ll$J6_UqiSARk1|v#>msc0 zwjJzp#XuBtHr=eyA@DLkP)Q+*6PvB;Vz~IVf}_iozj&vZofdf{5qSG*o{n*K&SM-i zDW8s8z0X-*7~y5$xy@5)|@!TAUe;{VMcv^W)+EetFbNIcKuhAZwarhD2!7DL~MtnVPb9 z+@Uxw*sC20!}NBzh36Y1&cWxGeoU)YFKwP%)^94|IQ<>4sScUAcc@tcy#XkTy0@n8 zo%B3gGpBBjG9}My_^{TR4nb3k7wf|>hV)TLPO0mjs1L;ohY_ui-?4>`rSa#$H_$`k zDIJ;>dTKDgT<$@(&u8xg3Ujj9b_n6hO3FC`IC?7YkEnt-$vDMhUEqlZ9pCJkzkgFI zmv_D_I;~`43l7l2G$Iw{s8k4Ug#HI&#HZ=#)yIA{5zU>|jtef*33%b8kBS8&U+&Hq z(D{8qs`l);)8pANRa5lh?xE<%S=)Z> zoYZ}+(LFv%x%fH*HXh=ie^6}bdz_n6DR8^j;Ae6eH1KqNVc(53cztN{TMygzpf!SD zgp!y_PLsovH|Zck47=F-JDoa?ktsqRxqz25Ihki|gPgdgt0XED6@s4Mt+)F1`zz5g zUVmdHLvH2z;-dY}y6krgm%QY~xm4;<>DSR$=~wOB_qW_7U!juN$fGfN;))+kay^Z+ z^LOg?QdDY2g>eumtPOOS!*9ugLOa0 z$$s9}q5SqN#bzA^;(^I&y+aI?N92?{$21u+ z3Nk$-B?l&nA#w`sZ;l9i^kv<>Dc_v%3M)S+t64~l$HjlFz|azBIW3cT5Gg-LRMMT8 zErHFiQz69LURqni0w=tBbkp?7Jr}9g4^4VI+dA8Qr4>U4wJpq&W1hx;u6ug6w|jnK z0$YxbwXLWX7iCkpw+6Z^tA7?2JGeXb1KMxT_s>CliPEFgCQuuoN5}2fubv&Frk@AR z>&^K6`Tpq-mxsm0>%!sHnNefmj*sW3@xFYt?4$b&$$99~!3DzST3+spqKx;B{r$ zlF>c=U3tfOh=KNr&y{1o|mmaajn)7eZWu6$YeG`Zba$F=dXYn z>+AgT)&2J_sNenxYj2~gGULcZkhekd_jkMI zQR0LiU3>kT7_YN+EtC2))rKK_OGYt+7fKs61}aK2MWjB!inM* z6nd`LV36bf$I=h*SH+UVO)sutT!OuOdRe-k>Bv;`2;WH$8ijghiyMTMf#uL@t>-hkN3LK(l#)H!pRT+( zm`4iM>+APs9u&?SsMHr99A~Y}Bf70+m2XUE@IFP@Mg)mB3xvv}so6?gIN!fr1vAvv zqNZdHXLeq622RtQJy7kPSd7V(3U{3=jjkSB)Fwuk-VPR?A}XE!c7RXpm!Xg8a2qaQ z$*m)KU|)FpkxF|aGrS&hMQ6&8zUYvq(Rzt8p)|)oGm`l5JnZ)K$AX!ubhW+8(#}I2 zPpCMBR6PrKXteFc2l_}1w^J-`@5YqY?b6k+PMy}}GhLpt_04I-+>JmJBN8=xM;DD1 zJ+$JtQN?2xQwoM@*};XniI2ypQ}0M^S_*~N^NTG%A-A5C>;j-Nza0C9IgG5;;OQw3U{p6@IBa- zMHLZg&v<4=_8z{gE1F9u+kqHh!TEjer&I4U7KG!m1;qfBm>wHTN6r%V+X8g@@Km__Ig%(DakTANwWHKq(u;XK*UpoorJQ$3RO*i@Rv z-i=gqD?UPu*QwVn5VR3?h@F>@ilZ)nk>K}_Rv0eN;w93A^UQt4yZg`igSkvP318g- zKdf;78y-^F)&92?1e3?0U+tUS5Tg-oS%Shdu$YET-XdWLD7_@+5vC|lM8gPRTwv0s zph8mF_zXVSNa3Rg6z?E}(I4yX(=V9}wrRNci>T@6{~#G$|bdw->X8 zYq{h3vW8QE&GUN`d)LCG?GQp~m~oTz>0!VaY3bJ=z-;XCrtdM+zntO};Zl#3n}huZ zwU5d!yR2i^vSqn4jF3hJ&xRDYJ8#`kUzOG?b#MOl6%lrFf|}yJo|~CZi2?h`cGKt$ zgqKJB7D;eoYbg>oci15K1D0~T2@mPPNJPztblOa0s#TgZrQGJ9?=G+D;KLEULs0$Z z{)89(mFOz5A{>O+r~p_IJup>x+##=g1pW4`5}zo47cZ;mR*J6%!EL;I$x4dq(r3*7r;6p06E%(y##a_+N$^@5e^JQGm1{J z+*qa8%DL#QCz&c8|D!zrkMl)GL93GL?6(7qtb#`?1#}`%n;>}+*=vePi8c7Y-j-jA zx7AxMT>5M8f7~=BI#aA$*PX0wK;j){G=J+#Z$Fl{;aJ}{=civqq&8mvXCjdOGZ9kE zG%t5u}Vd-Md0%-+%q0 zEz9*``QBwh!%}@6F|_@id*r{-tUbB*(hTOwc@n0zz3aO--JjmPX?IweUBX;529=%R z?>o1fdHGh?xy;^$_Mdq&9A&EBz~FRlgJZnSAXMA2UC-=JXD>-i$NVlP+Z=Povca{U zA6LE&j_xq?=9m?XpwLylBa6=+2=Q7Mx*j9!W`Toy6cDjPQKw z0$crM1PM+T27LUeS`xz7==J$XQ0cpo z^p>&8SDm>ABc(&jO$w>;H&r7U|&1yc(_bLp4R$9nmK$Z7pcVPQyae znLch0Q3~e1(vCj(vxoqwSp#hi2LIgGj@?c}rw`xdt5ahFLIk_zD5T&r#T~4jM)V@A ze1u>&v6)TlZ&RKhD!17}V65j)905ntv6M9GX#y@hyNq;j?uBK4E}rsBbPU<+FLA)n zN1N7qBtgu@KdC8QG|eCxSly^3SB=r{ZyL#M6oM!m2p%8N2gOpZ5W~?wzs0+aqQS+Q z!4njqJN$<776WM{W@KLNr<7a&d7S}D$}KKMWSvSXd!JCVmQ>o`L#O?qDzU$7JnHz= z5l-6Xzaljar`~p?HZ>69Ev1)~@O*VyOj0hi z(PLun=op3Yl~GhT^R}+HT3)C^8u;ukkbR03tC@tkZw9T@&Pb4r9|qEhxt@sU!+Vmc zW=K;%xuprFwQki6p{JgV8kZ+FLYq$?L3_2xpN6Os*UD(V^x&haP~Ue(Q7_+6DF=la zZsX0v$tC1J2GBb!bG7%paiF~Nw0f<>+Pyy6w%R`*|bWL8U)jY^ZavzWc#1K=m|t$D6X zd!m{gJ$B%xjeTE3C0b{EL6 zxtfo^UD-Pgut60?p2o%amy)$x*|5dkbsi3nlY)j%CRHu1d*_Bhr6vboa&Tjkgq~n` zg5pyJW$6ixFK!ul)ZeX^viaJuV>ED}vSUrHZCpvpCtBO1 z3RyozsWF22v4Vil;a_}lsO>sEraW)d1h?^Pz;=yC71S!4-IC+nqV=Pi%2BSf)LtjE zbI{J-^(aHlqhsSce;IA`ZH>3}NN+GTy_`V{^TNvJ95h7;jrf3;fK;yt1|@0#(v?DCBk&jO%`BRQvJ{-d#9=IukfhQ z(8>VQ$wv5!bgd7U4by!wr6y{-f8M0{7dyd~Sq2!p5RbjgC7&gOpu-$~r*0ppi}{2-iaxail_GuHdSs@yjopVOE@t6GMefBl64Xnc?3Kt<_mfq!h|;tDHa z!(tcNbNymYKWx;ZH;nDK$|<%NGtfwJYCi)ew{{mi3d-R9*{bbxtC==auBPMVrAFp* z0h`hZRkZ@R?gfx{nMAv zJm9JD|NfAr(%pE+vNWv4rP6URsi(y_Jk;@~dg2~Xd&RsF z+<7e=a2|>6V4^kO5;;3123P`R?I|qlQ?Um#zS^Sl+w{Ujuw=%%{pP3|j*NQxV{_D> zIfG&^-EW`w?p)kXBOk-*s~y?I!R(E)t;^cI3|m_M+3V|swUxQqoO7P+p7(2O;?O~BNP8(83Z zfwKrVVi}DS0`a&cFt;znmtvBX|FGBh!ib8PfzgMO667td~{TjEf+vR}|m zf3wO^&#Is1$VcPOwqXl5aMMDi4Ji`OG@EWBinu;iA&Zgsz(|DOnM}Gx|2wP#*>N*=FcZZFwQ$kQ=U*e_dzVI-#o<*U#u%3OZC%9*-LT*KXN9pt*602N z*@D%nXqKUNo)c=r8^2CjQk*oSR}dIy1w245+MQAHCGfM*04B$-GUJ~8DJ~9oNHYF$ zZC{A+ufmA`Uxi`(ufo{>S7BV&EZ%zm{d)ke(CzMdlE|`6ptir>(7XApFlhf(81tFB z{Hhp<>CGgPv>=B0@Y_V)63im<#z`tEeoK6%Vd4#zcD+=!Q~yM@1YHlz0}}RXD*w-- zB3r_Yb>0sHe@FpQt_Xqsf;t{^vMC4RIn{=XRspx_ zN#IJB;RMp~{iK`+pa)4J0j(*gSo}Z7Im8Hxq)#cVNu$|Zf!;y6ZWDXMhPUu6>@-)L9J_>8l`zGkKMSszE zB0ib67>OEknfMCs$C|H+70PRU-U=C_158WbOes$o{74clxBprR<}Y2EegE0pqvz(R zoq6HivS7e0v&c{VpJEcM*!;%b&)kwV6I=1se$c(0`a^NH z#-y+s8t|-s^D#847F#j(bi$Gn$4FS{808|TPGvZwJVgc&fnB1TF)z2|+;GokL%ln{ zzx3${5THZDvzz59MX1u(5=gwB(q;MJu5T`bBsC>Mg?BeTHxu|@h2c;M$*YWiHy7?@ zMj9Z;Z=#t78dneIB;DVs52<5ej_^A~5~Q<+>-kE2F#k9tV(=TRq>Z$%Vw#BJzDsJS55W zNFVSt|8UAcC4OaX?{h?F7ki_zW%X3C;xm2g+1px4qgy5gLYST|q9MNQBeA=(5Jy&5 z{C1@=#M!;fm4}D6OBfIgV;f7#%cg_1RRcG)AT(N7tGSm^l`=0xswgYz)oSnX1*+Y~ z7>`pvJOtzeJRCeL2I-duT$n$m-;-yn!f>mDR^cQUrss5s=gpjNd}_YaS|!kl2{B^O zuJ~g;l(7K{(qi?$LZI7wX@}&;s_+p+2eLKr3&oUQRWu4mtoZXy_^m3abt0o&I=n4K z$+6Nj09E(22)VY0*@$$ahC0*0FzIooMz{G0)YDEzrJ@Y+ZU zh1(JSNPm&dsBUqPQiGp@Inb&OHgsct4CxQJ4pD4E_3M>1VNd=?dWI8eFVY?SP2;B8 zFb2`JehBh@uqtU6*@z%O1-o0L8xuvQ$o9VdI}yup#7`rZJQME${@dN@-l0{X1e+NZ zym}q;Tq9gsV}|sJ`etKjaL#n7l$HV=E`dI!je@nCMbUiT^@~ki9)6v<6bH`9e8FPA5Un0@hFtiP4@7D+ zFy`n`C5DGcK^*s%Z6$=wyb3CES0-5{*JTOF+AO6op@!NO2Md$6k3ginP(anrs31wC z1Ag8X8HkfOo6p<=S^D>q(eZz!Ru%Odyaoc%66UNmEaB$N;Vmp zy#V?_+M!5`S?$1e9y%^BiROp}dHy+SxhCCu%JiBpESG3!2(xUylFJv%IBsv0L9EE)6 z6Bz^Tz6x&pR5>3&@{WXtcJ=ZeW#cGLXm8g94hKA)nBeymR_;Vt#dJXAG43UhqXfGj zao=$Z+XZeeg?-*^kZx0d(4M(zg(CcyULWPInIvFo4%e|w_ga+NVV*35uO`YU4bYWI zNv^6+r2nR?Ym$+R~-aIyvNRIzd{Qa!Mm{6b$@B}J=VWO9mvVwZv} zkY6mRrlD{5$Fqj-KQg(I{hXMgvVrdKfodbyU7^&0gIO9q^A=TA<2Radjgin`iEBVF zV@SsnU8RVSOq;c4k6Z|Eo+mw$9;$?RNk3NNtMTK*g_0-JbJFJJdA0owDOtb@+2@F~2V8F3P$WW0{xr|E; z0hQvuMb*1IL*cRll=8@7`?)Y(Smi}0g?YnZP|VmyfB6uYHF?Dk2{R0>e=ac$ZTk7^ zgoS|J4pf8lYh~K2DYv`zP5GP9MW$;IdptXWNAWN^#SdK?m0@g zJ6RD=BNL26c1eZT6_)b+(vM{6iX4w5*p3B+P$IMjAAMlgn72MEi=8J2`uj0xu`R^6M-cwH8lytj;pNJeEGLjCfOfR<*OM#iTDo zs3%Y4b6A~J6*<=|4t+e9ZMF>-mHlcZWQKh#>=2c+j8yyc*|dms`$XEMKZ5OBUSP;I z*7c>jXb#cYRaf)@ zlf$wlu^7#^-ElLT2Qk)Khb&m)eH%6X*FcTd9jfe-R{0yyv>rma8o>pzeSQSP?}!u${7>4jw(ITjqL zpCRpw@w^MWjB2XdZjQAg1=YsZ@vbysO0u z&Es&yDW^Z%P z3Hec5n5EgG1B5C~tT}lGtHCfUWUUfy$TCHj5W}*S1gWXFX8Jfegz~b_z36lp)4&3E zhI~7O6Gv8_u2%1O|X8Mg`)n|uBS2odqp#gqs8Gzwh8iR5}2-6{jL>a=rAB`Jz zhsPLsvLpz>q6(VyyN<|9E;AET`Rk?11;wFCZwg_$>z8emRJ~hIT2gToK$=r56LgWx z7&33cNZOMsFA!_N3&DY1po7f}FJ^RtRPU(qZ8_v~!F8 z5aAl;Q^}sk`IY9dn3R@XomEC%$sCp$r4Tq%OkOfa zgn)`mL-IjDgLxXe0ZK89n4yUbdq}j3U=>FCXGX>_ews7Ji^{J_Mv$m+H z*J9HBL347#kffrL9r2&j1ZhfZn$X)34FN`cvZ}4?%gJM*EO`AOXrnH7S3jJsujtKH z0Z<3FEtU}O(YrYi-;-wf-ixD~(^%oFlQC2!)fUzZTLT`kDZpnO8_hBiFP6_t*9NR) zBPq?IXx|4C=sUtpO+Xv+Zr8TELRLSfIbAZ?-wsIYt7r%z&&65htFoMtO?TtGwXkA7 z=|SKb`wF!N_maD8g)aP+2|3C~(! z=+xB*HIOHo){Uv5hF-&Q<40{BsbeD|ZofmTJBVRmvAs{+NJC91lxIBEwTtZ|r29V~ZG+ui(}t zm2gGx1j9?ir~vlPDs<#1SPDG%c03x`|@sNgP$ya(3U!H zjSoOm(=<2|n+1{Ew+*t!&4yzz-n$ujC+Z4l?1amj5?7dKq=#dN-&EJRNf$fC=rT_i=&#TWfy!c_FDTmq0- zbd!JXmE(pWW8tF;9b^;3#!rVy93Z=w47x8vHf=F6Q}cVT7v)RVFe48_Z4ebxY3RpY zjRxb`Jt^`7gC&A<{B(fH560hujBHiq=-xH3(LKJnCCFM>iJ;eMmg+l~BxQ$537=2{ z*4%WWWooO#usFGyy%Dj2%{-)-=-yKs^K8UH-vEuK}A`6vg^q&-i(YvTNo{I zK-zp)B<))8Sf$Z05-n!(fT`lpUMxym+KC{WkDDelFem^eHM10TMOwEQU&oP+ z03BX3Mv;+B-E8-^$wsK{p$VnYfScoyJ;aP^-)%J&^9`~u)}%=X$T7j5bY~L)^bk*x z<8q`u>;kkJ{Eykl;P$7_iQjfTET1}-gx(~LE~;R0h6=1SdpFC?K8bHM+Rz2FFt-%9 z6VwW9TV8z^-G}RZ144uEB`%Oz5D^UFD6#ghOe$jj>WXrjA@&gb^F@I0(pAA*H zfvYgN!dK8x&p;)#RrEYt7vWGjhGJGqUfVfSV+s4kLX{9@3;|CL5|Mca2t}UI%I50) zsHH;+R#J^+JdyyYc>N)jDK!f$8xsk0HMqEL>~r1wdW6FUF_4zAf*S0aA%tg`t>zNH znZ150n9|vF)8Cd5gaUhF;F@O>MjW2l=^r)=qG7rz7(*XU1A+v6Q&%pqciAX$7`Cw` zycUNdU{;sLdM2&Kd$<5Z5VNYY7Wje0W(`oL64ED`uwt&QSXYF1?p&GvT@uRcY-qff zVtGo#No*yUwm<^R)fj6DbCv@1eSW;1z}d?iVc{@0e6s1#!ne~J-y8ynedmiOsM^KNWML}5q}`!dy5F z!||qcq|G%%DWG<3z0nBLoQOm+gKmBtyEHX$0Ln!O5B;nu`FV(8XsM%SYMl~KNS!^G z$FO_A6<_9jm5Hg;XpgTN9=(f0&Q*~$jTk*uf<#253oHNoI;lvw)#B;WBgCO8s~9vb zD*Jz|y;F2(>$+$;W80arZ9AEZ&WX85_+fHuQI(wbk=bXCLZdI$d@ixZ8 zXaoP>``43A<5wfxq&mdRM!#0Q(`jgHz-K^vC+~1nTPQ}D+t>*aYbold`3h`qi zU3RxgA`GWh!YF(O zAPJATki!7edh8?-l5;p(#U?nn#Dt7Ot}_Vkc&Y*}eVN)euc7(nnSoZX_u#n)Mj1ym zK#mxbJT1pKKX9Z)>Qf7J;~M9u5V(3lRov(|jmWF58uLHp@u_xP0oy$=lfYwMk@BBl zK#g`L_Skq!feZSr@zPzDK<*@B!v|dM@x}6nJ8`jk^W~4MDJ$`>o2>X8wdNO58}w_FG%(M{Q1gZKMWH#44S} z!=Fyarjcrbv6X`y@YN&(AC@z|XoEfVw&+!y zOAIHs$1+gWQNU_k&c*{yN**P%*P|B+LCKQ^Oz1Lk<5%%U;(zM*JlPp&jkFu$mI|T- zx}vcLJJ97c`n*H+@A44p*6>8;y?=ATwmsw;le!=C2b`K6`9f~d!GTPG%=u6BT+cHl zGlU>)^vQaWdux|e5-d?`7B*cahF889YvSGeh|i9O^*-?lfT+BoI+Dw4PP(AyjX}1LlXx2j9#r{cnTe7%n8cb32uFE)Q|tm2w{ zR4}fP&YXXb7tnU*SaI!un@kC>pz>Y|;y&{KTIO|S!OZ%~K6|)G@5}aH#d^P=d-e(R zd5l&!5oy$ORV775rc(LZ;27qG!qI82uId%9cIaN&>>4R6?|K$>yVCh86#D$M>+gF^ zy6d!2_u!?ehU@hx0SgwX{Mb4?+dHeL&DNZfu8Kl4(b2-@RnPeFe1FJ4%Z|?GdU+`? zA9xs9I4^%M;KJ~DHkT3ij!)Jb?(NVF4y}37*TA|(Z3q0H4u)OrKMn>o>AxI|?jU#5 zjVkr@0g4QS4y^|3rOF2aE;0|4s@i>+)1Iz`5zQMGXdRUufA0hYYHAriF2hm>4+jO$ zx+G=%nwD3i#`gzrJ(3fmaOS{y(&FM`9Vn@i&$nQl7x8d;Lv6D_wTiDv6Bn1Ug|lnl zQ`Yl|Fq)kNKQ&N!6|#k_%f7FJB534|t;(>>mK>Sm3gMozfimQ>`Qke+%jC864vIap zB@UV(jApm;NRN8gcGci_pSe|!`V`u$tq`5t=>FWJQ)iSWX8)58)xb`MMvbkBs!s-w z&f^0Vrnj{Z_gV-mgT@xOm@kehZyXzIo7>tKR|T)8cjm-Vdu2FxTpl(L+oGJY3RDbH z>^n;>q5}o9KSlgRKR$qYce|ZxgB6cj6O)>6+DF?~u+Cl3Tv(g0!XDKk{Cl#mu9Z@A z#YHMoJ1^SXJB%`Es~4No*Um2dceL1Nz~0>IJwL{r?}St}4m9-AX)k+sO}kWWy2!da zF>_g+5H2PzlX65Sr6+N4vbi{T*txqjXnT>mexyy=>@ZeYtEkjp0KBKAoPX}je4;s_ z4uzM$O*d~e~8!^FsnC~(Cg{WESIJo{q{!WG<{bT{p5!n7rJg)|ZhG<}`y}4E`>nKVY;966t{L&@`1Kt6 zs{?!37>^|y2cCcE#cRysC+akc*+HExiV@@Xdj)`>Z^L#I=vM|ta;iw+rK)^ z5b`Z3hjKkvPh6aCUH`6kVbtjC8Zua4@kavO&7V2(M+#E!g4p!yMb?A^R8kW2f7WIO z%+Vthud%bgqMnFizTT-&o{$^0WFq`l2lj^<)jdtkSzbg{eY^R@tUmX?)r|7J`0D-} z=%l!1HbT6Hz}C12EZa`)clT~ptpkPoznuXFUG3~KPqutL+AA(>y1U`l&qno+fPy{& zY3-uME~`L43v8^W@2&c0eZ|jV&L|t-Woh2`LG8IfTAMQsI;Kkp#gnb_zA&ef?O-X* z@S*reQ-;j@$$Ij~MpoS1DQ#o_5y#s;A(jm$Prpz5e>nm7o7q?Q9{3ZRAhAFa20i#+ ze;WaeG?p->=Tk^x6uve@Zw`yC8TUc{C$6(uno$G&>|#TY&YdY6;7k>LV(q*WuNUEV zi`1tS-NtqTSpzIvnpcs<2iCt6e(q76-M+r+wyJfsu61!9N7Px{Fl1>5ML53pja@os zL~1{NKg2kAxyrh>3qF^U=xCQL2IP{fRFMzQ%KE&6FmbOKh!v8K!QndB4Mr-gn}v1~ zGV@%rB1tdq!cQKrO9pzQ)K_vU`f5t$tq^?kH$y({&SDSF-5oH@KwCMF-ed)_NsKDU9l&G?b+-K z4o=kUv%v-U9@0r{5V?#7mRvA)ueREv4gEp8iFBo5>*u@K>Y2Lv-op>EHCwu2j@-bX zn0Oipl*KcqY-!Fx8{-PHjHn|Vll3<(AM1)pq3!#t4B@_xWVUlA4qpx{!nctJiz9Mp z=Q}%kXDyALovm7(#=q-DL@IwgKP{fn?!usTa(~$BdF8kl3dlZJuwu#-U5t%{Thg64 zt-g>wRBWU|iwHy7t`}jR>8;8BuFeHl7gp=$9%-8kpx9Y*5cERplap0t@hk=(kl=0PH_xBq$u>N8{oFC1~72!p}%ra}v{o{i?*? z%y<<{ydI+R%EYdUR=tEvv7NLHk1qB#@hO0WRNTAZy8+XQSK}Y&9@#qkhdaHMvQ0^A zV#y=se|oS{;AMaPhX7zbK*3nF$}s(~60Jv<)82yHr~IRx^nUE&5~S)YY;5K3&XR6M zh|=1Fg6-WqhCGNp2NRJ}R3~OSeJBmIdGyaL*a`Tk*XEsjOn*l4 zG(gBvf^MtYa!oKuepUK61K`f*-wc5EKYtkj;e7uX0Kqx`7yy!~x_=u0c_9C8007fk zUIpl}d{s=0DeGWly}FnqL$=4+hT5#r6272|P-BNJlb5t0L>81uEi9!@Kt?hPJse zGXa%cKkX`^lLJ2ys~j9x++>)cFtUhAH|ubb|JYses=%LIdAoTR?FNyHNur-pv_X4W zPP-(swXSW!Ud0y+z%+vxS!x5!YvE@sn#oTC-q`^*v>KW#H3s^Rta_f>55-?JQ?7)vNj;u@8pW-4+^b z<^ILg)oq5T{C9#7Pe*pds=poExU@3F@o(V7i^+l~hIF0}y*Tn9|0xCHL^E5_w1`#O zdhcHwAxk1@h-3Jrx$3cy5{?)t4Ich<_kk-6)&0g03vdAB8q6^1mG{eB*Gm8J|NC11 z$^YB>mj1*43sM*TPyS!hv*;iGe>}hF-}(P;ssBIte?acP`F}%?zxe+&ng5IbAC&nw z{{JBRKly*ood3@Mv-JGM|KH^N&Hrc1{u}?Fo%_Gx|1CrQ8~=YOJO5w!{{kJ!zxjVV zgTMLzo&102|KkKH{)7K7j92_G{6Aj3;{Ox>-;wbb|8K_gzv2J6prNCfwfT5_4Bmal z*{c#f%3gZ8K6diBab%{l8;g_u#bjzn-VE->8{5*Cae1y_Fx^qVUh-H+2j`lcW$jCe zxz69o&rnlYsD6ic9YSGuy}j*}a8mQ&BYot#O`r%itp*gS8KOKG5oV+Ghrj)c{*SFy zspvoA{thjicggo%Mbf@r;9_CNLaA~;)*n!A>i!M?2bcc~{!a}d)@d5MA<77V%`%xQ z6FQ>+@Ttu?6Y|K&F&I*Vm?ao{K#yP{)Dq00`tR(2z}T+oYlYWJwq&uQz1z$JH|X(C+%&|wU*VnLdB#TY zG@dEu+du^7PA{#oTl+EUU#8D>XoKf9Jy$8x_ZV<)psnL=b8^lzmyxsgJ;l6^k$uT4 zqV3dsyyyflf8`d~?$UUupG>efP8A4eAusH29bMUv51T#08Q)FRE?Hg87Scau#oRIT z&s*JNOu8N7vV!bzth?d}vPRG4WlxbPN61?S3b?1^GW=9T&o|)h_I#K|s>6vUJf89K zHMF`q?2hzLPVl{qyN(~;ULK}uDpxLLhT?Zb|LQGhCB%)BapFqX?K>{7iMV6>qEJC| z%zb|qaSW4e!HJCWRNmXhb?kV~oS{kTPV)7I@;(?9IMqXSe>4Jl;d+otF6e2G%x*En zO_I6q=+9-7u9!|=%JdDi)v9QRX5{t06b_<~D!&5m9D9^-&Tp9@YT3Q2sVb)tIf=n> zjI8Y$iRr+Gt<)?(9m8nDLTz%?+o@FxFpE-OS@#H=r=fbPmhrpiSHwSPgGv|$Gwr=8 zO7Tvo!@sjuIllznv^g8s= z)Fy}|QG4R2rEMGw53lH;#)vyJA)zPoK^vzxo`{6Hrb%o2iceoTC{tA?<`yHFaQ&7X zE}6(KzVH8blgpFd=JAG3Y?CX34tWyX>kiw3`yN(s(uj`pMy8c#^K6rz)KlL2%lVPS z$9MI(%>d}T;m|2V0bQzmR+E2>N~y%y6D4iLk!!ayLAX)xkrOPJ1k$g$(~ z;4T9EfF0aXaKYm7Fp8zsU|~2=m&Pe354OLBhw;>`7>rtpsXT-kiLQKvX3?!!q?G-s zVU;w4rolqf32mI((z+{U`@K4+Go?J%jnZ!aQep4mQ@q-NnrJ6p{H%pZcEstDsrxYI zW#aNv*chm(e@e)1_|`&-l%TMBsTI$wda0ABSG&3#V!T7US%PlFc1VI@5XdFHqTaVHH*HuFqbJA@*m>GM-A>IK^pm)rZmeqyyQl}%2b!<1D( zXRG92JX&c0)ykHg!wlBil^j#ICugYaVGo6#!>mI>r=5`N0B9^^uSp+IJe+E_pdTD|@U*Ftx)%rNE2<=L5Ex*#Me=m$6F^Nt)pcgwzp13`MQ#a9J z9y9VA9GbXInOJ1Kx|O4D38z-BPru;&^%igZVpYQ3%!}qjq)+d+h>^;H0lK_% zDota`OCiioAf>jz!Z@3zYB+MJLa0&ht51JOG>7Nf`; zw+aFHmS=-Ij~xEFE`yHpG2&%{gswo4<{@q+*P_e81o9nTfPns3Y0}1F`VKF^3b=U} z7*$8Iz={33o{GbnRo4BP_MmY3~!QQsLPx@6tW?eK5nqc5^`QmIT z;36M&_$kpydH@+LM`k=v4hHjSzoP0&)Ou`cL3dl;ztrs=&udrh2y4OfwZb9L~9n-3X^5h`^Q;$#}8- zyn1(0dLryqt!g7l{v?Wd)g^xz7VwN1 zC(6t6n@BeY1w-FIoj;QKil)-gW$!+jZe1cBreo*BTlzNVPx2hh|P)k|nzxRfl{8Y-38D@dCJf^l ztIHB7rI_)CX6P0@01tOd){E)2(OHoSo9d-WBYFgy@rz*@9&ScWu^40GBSxpV{V<>p zN(Bw+0XN3PLp(?}3l`niE&?H#c1=wR`Lk@KPJqasY!)HPq*=tBXaACt6e_T6uu8;3 z8*P?L1b;bvD2^E$g(tBJLOOzAC^{#bIv(H_GT-(`g#GD{#=Mun zmULTTzez8C>H8oQh*Hv%X$PRdnh_HCgyWH@3XnJL8O)O4frbAjaf$|40cOLnC9+51 z4^!-Hb$Lip^qK`-G?;}(bpB2+P>PuVyr(b$x$vGrGwIf}Ig%&^;NPPFtm5)gvoDnNO! zrgRoX1pq!=G;=_pn;bBc$*~+i=k>!eS#}pG=8w5mR~z8C7`-jnYR=k?oh$rkOJ%v~$?D9Pm2Ofr!)^o&?R){V8zsoP)W z1^iYsQ8}3{FZnwdJK?acs#XFe;u}ugzsd{F-{l49Z{leXtVbR4IfNCIL=KMG=Fl&! ze-S5|+5)NiIID3&*+zb#X7=Il@bsYyz#|B0%l(ntKSlR9{xFHLbg z)%fr7LIQsg@P#71YulTZG%8j(bP_yN!L z+aDpiW9QY}#{)PJ^CK2M?pn@+l6jthff~hsD8UmeCW97%$T-a;IgcHM-;2IYq z+g#7W2b3Kbo@Uze5h#^UW$yhZS6;vK0|1#r+Dt`r`6Qks!H+{=6ie~*3eDpFld-@h zo_(9eO?B_c!&Ij)-#WcaA!ZtM2#u`INl#_k>|3z1(_emp$(GGKE-%EMiE#{K&CI zf7G;?^RW8qLn%6l^?+9S(XB%$$Jy|f;gyH`_-Y=gPK4 z$pN=oZGQv*-?;?E_SSZgta0w)r-H3uw`pK+a0&sWeAULR`P_GGE0E+GRouzOuT=H!o46=Qi5r#j8R%e|Hh1w=R zQ;O-LxoFL^Ke<1oHo2&&&K8pKa(iG^@CJlWT>RZjaDDr;i(z|rlAdLWp?P-WHmh6OHg5Pt2gdR4n%o=z6p_hMkD>;qd0O@ zy#d1MY6a32nV{^v1ll0eQ-UtDb|CYu@T!nAc@Wf;f+~hPh<@9@`;>d?ewutV#+<`} z;|q6B^?9h}5)D#I5)&6uOSj9&HS$I#rZ9;lrl^_*iM{s=fp=UOup@d4Wc1V11;(~~ zFTsQwu2BsSJyYX?r&__$@5`y-WWNF3=AK=sU#j$;-3>YBjLnTNENbLNu3?eH1 zky=9dZ2?i}!JAS;!qp)4KS%hfY~kbCANS_q^C!ZIKK1Z75AkV89zmh|1(*_wD5EK$ zy@W=sr~$4vAm`jPTB-|$mjzf`W`~1~1QB7rrGkBY5;+bOySqX`;^dYDGBMkHF_aVQ z^eq;t>!B#a`fb}B!-PPO?N}Dnm4b5;EXW^3)m)OopmoYPVRgZxDkCQ2roMA>#;Q4y_f2mJ($!lV$j=1k+jMHAInF=JutwYkj` zl1cJ(gPHK3&qeZ!8-5TWL>kv=D@rKF*-8i&gaaQ%$Lt|of~9apvDECEH^{|A&n$^Z zFKB8Dap?m93e_|$iXzrl3>+Zq?z_2L(z^vguS;AZ+9Q9Ha+7h z&CI;wx(vHQz71;_LN=8g^@k*TcDczDz%cA8`VMPRIL&PH6!NJMooYZjp6GHF{8=L0 z<%Fc4_7TDdCF#ul(HF}H8JO|vCxDW4>kbH>w4=!WP5N^K2n`c7^nX_q-XO?&-T87M zzr!%yTq1cjs)*$oFRp%$l#`xZ06|yRu6|MC?&1JJ<$#FTRmfZWVj%b&Cq^LXS@(5- z&@ygn0Kkkb+a_>+@taD&cRD%(fOXldaZ&x5!zH~meFZPByZoY74;n#$7VmFBK;m9u zfkMrnk^Lh?y%T%~nO#$Shgdwb_=TB#O87xq%bxeZI7XEQJ>e8(_rS23B8o$NvLSC3 zYpdtzCbYfa0j?h2{ezOT{phB}rUbTAGI4{hYudR{^#EObxO+j050V^ChO!RmmrEdNyajJd}=E2y`BCQcb0jjX9KHan=F_li0rjUL8{} zjWsXgG;2bsu=ioYu^_D=fZ0Kp8cDYM|6Td|CcVhVnuz#(uhG z)TUfAc`1A=DgEM57nkrGYrA%XlE=zc?rH>%d>e{Ua&!{fGriFMd=T9 z?b~MW3h4XG1RUIKaIwofIf3JcM}In)_8>+1NhEry_TU7;57UT>%7`PsLnwwi8m)lH z{RsZ$GHRONloFn3L}Gf#+mI4AN^&gyBiX)s`RT6txhL3XE#` zQiZ04R}_^qV&V#SkT;@so<_cc{<)u7VK1iXl4+$|L zm0JUa2)Gd;%|z@_L_xSZiPLxB>^$hT@(=<-%$1Kyq5`3O)i#j+`t15(O0pu96K0a4@%>v>mpf}AT1FFzjT>GG_y+*xonqS9NLeB zwALya+meoM{AiVhnIt1+eH7hy>uvw49UJ95Wa)Gj zCLr2L6IMf_L5Q;@QeHHK`YlTxV6Ik*6|yT{(TV#FcRL3wa-b2LDkBDxR)Dw!vh{zmaYCH7b5L?jCU_HYeBA8_L8M7J)h<4%`c?o~$6P{>!XW6IDq#Fl zkdicKz8x8jOYOXH6{IKjK8LE%xr`lJuuvnR6>wc#zf|Lc01I%W;Q9JITVOi5KSGp8 zZbjhA`we-DI3t3BP3m%4gsBXYI+W%B@SBeJcJP7{C@8BPX@)3Mz~plR5drj%2l> zhD0lW%BJa*^Ws&oH63(xpVlm9i3$KB)D-y&q;gD*m+!igvrUE~=Tl5ufet(*YI!Dt zsjS2YY5ryw3{+Gq(_7g`nCY-Xy3}i>{uL8LD=u7N2;LKumbMWYnk0v%E#El;h#wce zoG6Xg)}nj^-LIsY82uxyB(-Vw6wfC^Ub7*Zo`IdX2eKy+qBDaEj$bp-sEF`8p^;IG z@H<>zoxl;B4&VGGUOlPl7%0O&XPi zjX&1u44x2KuMa!QH$XbUH5SajwlrtPi{e1+H!6!FxACh$uv$mr_;`<{aJ6R_sF z{Do1)W8_)2N$^BX=KytLXA{V0<&|rZ+{^4U7S&L?1j@f1r!4nT-IP4s5mN}!jG!d@ zAT$z^LHiO(DRh%@<|531U2(-*LA7+~rFjAlAqhR0c|`<2Aqk8CNQE}x){=2?f{gM; zQFNn;GQqT4QH_+UPIxhe>dUA##NJ!cVrxZIsW84c^I}ECP@)6pR8v6BM&W0&GnAR$ znmh$QioI|GJV}Ry6}i-7cuCCfDLNun;PoI#@qp*iFteovh)DRJF))aJaWGxO)(K6j zeKxE3=Qa%}i97M=?-y^8VT%gtt} zMRJ1&2#6y)ix&y^j%bh{e)_rsW)CG)#MP;WBnWlfAm|FVr_ZRDC9w*Vkloc4L5QYX z0PYkvjS1)8LQ*)@QtB4AmXQq17nLIBf~!EM206m+>>_FvRRrQ6XbIMTgat#>lbFpd zaarqv=PUdKgQMrsBV10>x`c%XSs*stLjsD69Avi2&rjir5qTa5xIY!AWZsJXb50KzAoqK9KbP!KK9Iq^h z|CDZC+N|fYti^Zl4>ZqL0L|5|Y#vr8*^mF;pFY;`9Z(cr4OHM%=d%Pi)OG0PutJ{oZ5=bN4;RrwL)<_m}I+ zSGDVfiEx97M2>W#M{z(>zs^N7)?ow#w1w?r(S)MN28q-TPulyftKpN$Yjpvt@kYx@ zl&OZBgddHBf8I9oZ~yomOHf~?Yk2~w`~oREpK>v?*6rAvbOwzmsc zT_-AIhg^D`(#4AN2PbzfQ8F7wo0r_0xB3$R19D($eLU$}uRb?*hTlEpmWrDbIKqmz z38v2*k6Y|Y$xB#!UMiiFl#($+2C{Pk*VQd`= zYA9ctu|&2&c>SRJIe^@ArlA{&Rxgz_I?Dpph6d8R>qQz;UQO>i?aB)wKBX#qSqbfZ zXCZ)xxc=$uCZYshef}HI5f03Ys7tLce^(0wM+kLu+c+HF9YZAgl>rj`PqVmaZcjVD zsFT|a&;op0wQqa?D;-~iZ8%_m?~GFW6(2<@cMrh5IbaA#W`x!Ht?qo#N*UN?VP6m} zjq}dauPG0rkc^YDlwDQS56GzNYu0bww+M8HXbdlcfL~8<$`&1bqf?LVVScn<(`zZBw>m65x^5Gh(#tHBdnPjLc@fCr{T`cg929vbD+ zJTjz-qR~0XXUGX%-KMt$J{YIq8RcdFbn+eJnL%&QsQ7~%(xB5Nv?@-grlJ1U$Ab8T zW)fy02G$U>Bm7-!*(wJ6A;(z?dpE|1|8&gM4C&$0Ot$&h@jcx8?Bwxidy$uRaUYEL z@=X2x)&2UIGw1lQ>dK-~VI5o0$DDY#U4C2AK|K?)Vr%UBxLW*VJ2S}~;R!W< z$^pEsn;RM2^RgY(G&H(dV>xHXeINSlsh_!i|I)0s*~0p~pF7+x&K~@te6RmrhUYAU z>FeXD&CzXry;|h|RJ(p|^KwE_cF%m9czl#n)_V9JBk(O4&{E$%MHAvQHD_FT&8@!K zxp~2F{^DliGQap@(ZSWp_IlZOceZ!xV0$|~eV*ApKiaFt)%x;$-yfOM(W0)BsWR3% zAUzma?o;uQzfJFe{)KvYz#$nhfws0A)4Ytb{8sef5@p`_Xv`Y^;9TeGfEE?btXO5^ z(5QWA!iInGVO`}j_sTr~>&$s!l}dRhV*4V`solB~ZHIrQ+%}TfM)qIX1-<7sNZkAU z2vajRz+HTa%(e9N-T1}^NZ)}4+VX?yCn!cSQnd>5f^T@8`$OGS;9-mRepp34f#6P@ za$Ntzg{Qq;qe?p%PO)3hM%fXf7N) zXn^88v2^3r+W8@QohO5ire9k5kSv4MBvTd+KM{{ zX5YWs3+&;4wHJ!azuOD$|E0YU@ju!N#(%dLH17VRz0h3of7D(8oB6l)0@>f~1?hnQ zllFqM{Xgvmr0Yv*M#EDc=8Jowp9s90S%B_tNuVAnKRh}$3v=TTVc2+;P8}Cj@$hLS z`=^w7b_@S$FAOREm-d2`Kv{3?I}HN_dt3qHU2;m{zGeXtmX^|7EX2stas!s-tZXQG z@|KjICrIPdlKnZ1fg^MLImY20r5iZh8(m@e!^LY~)E>Exof5IuxOy7ZC!#L6%GV;Q zohT9FA+t^j* zax2j4X5#jNc5MPJSL=XuUGE4oNjn0Zh@CpesH3F~u6(d0uPzd@ocMSqqDA$w#_oKh z(&h^F?1I5YKL_Blvo-TbXh}n>^3LjF1%_c1wR@v7{MYpP#rYx6S3_@XvK7s_Rh4!4 zs8*G7_(N7*%PNJ2l!wpqK4n7AcJjre_1y%T4l+L6=D2eGlG`OD=T*vs$Zp0CM8t`vxf*T#mVlT6+Issb{r9l8PV4F7;?Pq5TwgDS+zLP z&N4^U&p1x=6vthUrnu&IY(bel(u82K9m7|tXdCC_7I+RCK>nh5yAzBP*NqHlVkYZf)w+qBUj(Ed8{dy_BiwoyhvLq`Py$L@v{L)4;VB zYi|G_|NkzrKq2-YiG`YD43U4VimOuBN`y_d2;%xS7>A?B4gM8!_oEfpS)T3`Yq)52 zs`HXWm{AUB5yJ&vTs5EcKH)~eFK~mQ^yZ=PtxMx_Hw)Kpt%|j?2P&*#E1PovVO^oW z`Ur7JTta(?o~nU)Vd zHt?z`9c54~Rt}XeRg(xq)@&7_8Z=v>|49x5p^Udz9UuK9*onU$Tg>Z>zbRl?R{l%V zpj?G8&Q6Xm-GIEe81Z{CTlpFN%AOtE$~bR$Z5+`hiX$J;#anfE{i&k~{pu<5`*Apd z0rsB6NGr3kY)0k&^`Hj%!I1Tb4)Ee@@i%(+Fpm?aW4k1O(q4K$p{Sm~YhkySJ8S!r z>CXRg@|{5h;rL04aq`ZvBDt4Zcu;gWV$sU(Il@D0VPQGcEyAIRD6rpP(<&PKB#Dg2|3O$QRWy=5g!kzK+_ryb@%OQphN}eS}0?|N;u7{ zgd&v@ccz**;m1*h}R}&(F%^~=L^zP!iJl z+e6Ejw;KmwlYi%X4G6F|WP(yI2PvBV6=Sc3A!Ra9QmlgcidU!#4Rv8c&K<%Mjn_Hc zZH(wFV_$JkG_?1*ZEE|aHT@yO4_p(QG+vuNUYjkMLj)11P?-%ARM@oH?<+n?#P>!A z-j%R1MlTqDO7sw>MvuiSMUR5xkVMVADWx83$s`f4D))0@mZ&bl*p!}UMum-CiNd5! zBy#=jH#tzvI92&aYve>+P;lQDl}A0@_;cScud?YCy^<+x@2<;(McI?A-~q=b^r-Ou zR*FB#MpNzZ$Cm!Br~!EgQ`L05R`Kj8ewAX@I&%PN>_2o_`usA3VfRRAhT4h2Z>-gy z=p5UFb8Eq7YIpY=6IL{}mZK%vXBs_gk0X!LG$OAZ!d}Jb< z`+7<=BMygxR|Wq7?6DtuOofTfq$kD?jJR^tIIjcOWSMwyIi70w-(YyS9+F0#^DOk* z+H$45`1?6NFJcky&$VS=#mrcPn@J#6&MirjCQKA`m9Aw+$Ve-05GpidO^k}I=wPAv z?=-N`oMTc!_98YdpInuE?)CE_C_vcdzRLKZ&MJ zM(|;)S+)P1VAO;!W`!G_JolKW#+og5^)uk2K$9Wedl8dX2GEz;?8uf1n`u}bmu7+3 zj`ADHWBtiRixy04Qn<_ZJTF%&Sq>ytFLu*`WxOh!AZ#XT*fzXrcC|mKZXS_Edjff`1Xf5}7a9!V3CDi!CX)6YsXm*>zADriYL!sI8h}}J-28UR@T#^vUfpnqOFewx zq}R|b?;|gIe*aQVd`MIYlipmfhRQKo>CaKYNkTe%0wb%p%=xlc#Da4#@&(G{0cinIF^tGZsY^l|t$x6z%m(SK^ju;iRyuh;P<|@-VdF_hW z;t)!4j;j%NCwzU|;L_+=Knr{4MNf@*wcEMA{O3kw$|{Kb?-*7J5} ze%;~Xk_2{01}uL(e!zzVLvr*aZ< zVdi~|c?!`KDD5!T3Gc3gk@7gv|E;aZ_9_{z_YG=S#FL{YgYs6{U-1TPE?)0uwiZF# zS+@DZ^5YT(yb@q}l{r?Y>}@D;aeLo|xS-zh?xbQB0-Ku}O)GLy%5RAbSYs;8%r6o~ zg!p+l@Ex17_&dzN9gN?4nST?WuXkh6TG9qeh_wF#UCYW%aoD%AD@0G89eJcs?i`24 z3T>f8oSKEqy_IIaRm^C(^#&m09`a%3FkshkJQeA|yA1+AH@tp&od)(RAyH> zj6i*A9@^Y^X+G4{3(2iS&`CG_X6jLw6N9+&`gX)?T?QdbPR?g+{fpdz5&xDV{MMIr zPT!7!7Yo+?_0{h-E2}`p6oE}odnV>{+)W4!=zaYNh1bgc?y7ja+{cUwS-BbmIxs~_ zFYI~-oIt3AKR06fjYD1ME`Dp_z2J#S>ht0)L@IWT9GtuB*1unP{*P?~3p6`NopIm{ zz2jCjlpdU<)nan)Q_1brY+P|U%gG4dfGD|0Bkz!nekkSa9Av)k(N>DKc??jA_4-e! zY3yIv9bLq#;L;5rNYffxMXB@aiZ&jpK}G(&q!{u%R!sYz+V{>WT}TEvi5HugNKgF< zf!>caDNRuIDUV?@qUoOOQz2p!lm`VWQN{yvb@d%3S=eg#VVjKKdWMC8xweiZXuVn~ z6=P|1lG`C_{f)l7^wF>KZX|6^g$wD?ypM${wP*3Pju95E49UR{x2bo*YdPi#$$IYH zG_x(;xr%X_*Vj;hSN(M3ey-esO&5iFhO%!x!+6`l_Vno1fv~%VWZ`q<`6cJHz8u7R z$SE(nZiH~SNKRx>cM!*!fv^0ilb>Ec&`9s z)zg_REBf`}V$&GztE6HIX0r0Ch?g@tYp}qx%zA&Ndaso&W;3*%Assp4Rae^{ z(wg3E>Vmj<8wJq=L|XGXd;Ii_Kx_}k8+DdNMaE{mR@Gfp9ye76v`^3Lqh5WHDk%KK zl1q;E)D=#yh=`FqdZ?a(9s4n^FiThnq?{vj;9RX0J+U5bFSJgYlG~r0mMt4P2nJ&O z#FXt>AzN6TwH?#o%J(W9bQ5Z;xLcC^LJqntT*@acFdQxWZ~NZXB=K`8J;A`*Sn z_!ZFho_qY_wAw06#4gB)xsnOrNo>ktbZpN`Y)WLpbh*L4$lBfwJT(|wUdE-@w$rMUaMLKT zlKO7Xxtfj#z&(yM^uH>$F5NWfvXclhQYE@AgN^-_vGLWuub3Fso(-g1x3u6}UKM(M z*Vx|mJhnQ^btuW1y=!c9Fh8l{VyGHa^JjR2rPN$E?UZ&yWtk$}M_;+yol)AFt@$D5 z(W{vab5d;G<+!#py2{+a=|^|E;_&9B@5{=H`%NT>S3z@!JrTf|iX z?4gwAt{K5m$LJw%QedPp){vzg!@SSyXrZ`cc_mHb(xhXbvo1+{OYdd8$|a3$tqjq^ry zu(qY|(e>XN78HPNz1d}b#_x(Mj8xl#Qn}HmOmubGOJ+uDC#zfKQqrKO3R} z3WhUUZ3=%Tx8^{h5`5!Erl4GRCc-0YKION%w5%H*a@Q1m_4C-d3P&{1{%t-fSz3K` z=$FNklH6tGI5J#$nGt5E?f@m&dd{j9&|p&+z|ne6H;Ab#@OPWh(cZG>>e_GYb7$e{ z`6<~%qZv=5>Aq6=%eEj!6=#_8EFaHd(}kwa(4IH@jfn+*RYeeEiTG#*M?tK(Zl#^5 zcg5BKrGCZM1|)OE)(x5g+ulQ(LEFv`Mtj9J6xskU!!D|SvwB+@d@l=CDc6-&Q4GDb zrq2)Xs|{pQQqiEJTHE^pD%m_#MXa$@6MO|4ie=e=dcZ}?yCfpX=n9==$fso`1Z$Vw z6dpc6_iBj{%%)|CFK}omC+Jxj1Uzzl$N{OnP>v$ar$3A(b9EjBKV^K#m{CY5Q_fBf_+i|v z*E<#XzS&C>a^KoD4H__x26gSo(Fo5H*=^?0&TF!E?G#X2I1kr%EIp#{h>)xLt`KCb zqwfatXZ~`SbvDgn)IN!Jx^|0FUB}d9Va}tKgnG6)^nKW+w%Gb^tU=l-@t7t1$&?y= zp6&QU2g04r(%N7dt7)$J_;^~YkBiB+4e+4XNaJk(_1X(@DN5fQ=pQa`8T zk>KQrv4oTRnT9c5nxk)KvTVm1-zPbJ5-eKr_Ew9*fnj^8N5@sq&b6bv-Pcm@KNB(Cy;D(L$L^a1R>B&E1Nn3SvhO~nX^D6<; z*=m}qQnGj5wDT@R<@2s#L@D#`zCeNVPYzTL^G~)@k(@cO!ZF3%wCFz*kEa&N#j?s! z;GT;-MSdRhPL!d-sTU!usWOVHek3j`BArI}`XeDnf37MfAeSs@vn#p5 zp>kF`{170o<^9BFEX;z5>{J~_5Hhp3Ia7nVe<+nSjFx|v#s14 zW4A}IGUYw;iv;k##WQ>0ibXp+LXN!ice-mGyp@Xs0|t$0n}=z|p$dxJkZ*o%Y26p{ z!iSkh3QpabEhyxPQ`HYtQFKjulrxloO9V;NCPf&26JFVIoIQIxz+f;Ll}K$+$Sd}7UZ2t5E1Z)g&#R^)!d5&C1=t_f($PG zEWVtMaDi1hfWK66|GTFgA~|q7X&0?E5x#KxA}qoKosZfXoN2?_?5RJ}~4F$jQ#9f*ojF*)=U+!n(zS)>$)as z%1$m;-2LDGT!(LDccHIbz!Tc@bLnnt?3|iBV4 zV?5A=xLkk`=Zlhu0L9@e7p}MBo2UzjC(J^l36tdu?K_-O004&EzW{^1BA@_rU4s>kL6yDre4-Nbln!j=uqMJZ}V)Q9Q=>4NOwH9eiJk*>4 z>xb0!PiE-LA6QwU*T{tny@VX55#)ZNcE6JDo&o*>Xm32j!`Zyw?WkLMHdk+W6Pd9Q zRJhoFgu5&9Xsn}uR>)#4aVn3`lX5KQA(P7U)w*(VEtvo?jPe6#6Tn|U42s71=`r*F##S60* zHRTr9uPl9a9ajX|Zv9#*+_HN5XU}hUUjyjaD35uWF##$Pg1C|64D{gfyNTPA1~Po@0G%()Xb_NMs*@3WLy1u!ua{LHiTZ zP{+`IHZV;nvwZ_fizL7jqx#=V43{BL2j~T4#BT7Q7CCFy41W^WXmN}DHpdv4oprOW zd=1%4CBZ2<>doB}VyVhO+2K@2pv0)-i$SM;blYpsp8;X_A)3d-ss53F@dc)2vW407 z({0cx?L#WxDci^T*#%E4vytM)*;P7e(t^3n#5m!DCgRi}3=nW>8w@aSxMqgSParFK zsFcKOPB&wQXF4zn)n8g>2!Cf7K!Fw!51d5?)x|r5tAkU ziCY(*BH_7IHkLzHNv91VheX{fk|8FFHu zu|h^EBG%+5jS|ZwN`HZApVD5i>?OIvskx-Gw|#pv>29SEOv!pn7ba&o)*Y&#bt)$= z$!^b8qwhbKI{ub9Baw!IK;qr&#$K92I>R8umAjmE;Q}Mu}a1R<&z&^AcqgUT4LTi^sYcC>XKq)`vwHu zJeN%^tZ}M6TaK_Tv(GtCjlsAK(!787n+I7l*q_Le z+*!noFAQ#W7|jgD<2yzaNX1>dg$j|Sa^In5mJ`oX7KRC7hOdW~6ae-YD$?2!>D=X; z!Aij8R3v!;l`u!UN};E6G?jG5*n9LMX!UYZnA}n>ER3lmo>Pk)RM7v-FZ67%oNw~} zMJ`M^+$ktxSF4$$n^p}t=GJtsxkkrOO9ca~ z$7NCE$ipMeP@yVkKgR&`Vg@4Os^zzM9L5qeiJ}4NR|d_9DCA2rr2CB!|cl0;$FJu`W>}Me|2VuLtC?obVIk z{(1{+CP*>8$rtnGc>5f5k-{+~NyI~B4A^3F`(XSMF|j|P=}eGv0{(Ifk?q(e`BQyZ zLm{$XxzGZ`L}y*ugeUvZvrP=YWfjoYS@2r6 z=X$!tkiXgjo(W1xQN&#tO0L1aT4CreL^{o`{hdQLMb0Qfy>>nKEQ zK0vO8%)pb>tv6*~S4kK>-5~93Z^5A4bO;Z~%9nv-Uv?f+ezj&9^JF$qJI5ea+p- zETlWfHZ(z2Dm?}xWW`uUd~T;`jQxGWCBiTT#1 z38I<6IRTpsbcIR!D&ziKz*wjY`tqI59CXG|T6@!g<(UpTUfZ;I4Ew;8tD&9aKVpY*!pmELB#diMAE>ILD_5N#ip)GJbt>}eYXFR0zMIVE- zYTt32yEr1k=ceM&?-sUaox*vNuA$fES~W~S)esndIb8Kv6p{uJT1OF8LCqpezn9f% zGh89f){v%OHA@9IpENsP9_C3p@w_?7x>WAy%c`#;uafj%yNm2vM0Q;#3-sly<(iEs z)hmvMnyo%P8^xgJ+!1SEU2~^TFTi;$uWlbkkg}J2o9k<5^G1lkOy+cfDdV8Pa_A$Z z!;fgNs^tTT`S%e(TC<#f*0eiX2gm2c14@KBe|#bwlEygN%PkpRIjJ#pt?d`R+Qc}j zZ5$7dWhok6^+U769kR!kgF=*~`#YO&^?9Mixog#MUuzQX*~g=))-6L!HsQQT#W|40 z!Ce0=p$#LXA3^+Vjj=01oxN4*doVROa;#~7{w*fuoQ;ShQq@KnGH!>XBF(KhbjX27 z9rdAeHnpzaPG}OkI47M&VN$X}O9Lx0sG} zD`%WlbuzP~;+JD5;L&J!%)h*a^MAaBF=mFi)yFFIT6rRXx6nO!onCR<`oZigMGBsr$^7=40ta4!|yqA=2UpduG1X&602pno@0*^Aln zTv!d&-?sZNxDaV!vjqSbD&ov&vRF5VnZa+eRj@zt0pp7oZwTmOxjGtFeX{-qc0=C; z*1{^LJ8e^H&E3>6(AQ)-3HV{MkjD#)pp#=3ja$b3$2FY77X4RDkmIly3~1ipNx*MEw;PQm!)T zG0GNnfB@n`cN{=m$beCbcdqk>DnZO=lxcxymKL_9DQRQ!Yu%DOtj0^PMfx z%ftjXomvIpEtu`RFV_3nIOBeCRo_sS)uErw+Y^3cn9qQ*N4yG{O@6hTl(2`OqVi3K zBf@kvl2pxa0p)^Ac6C6eiq0B{Rt!)fBivo@fjK_;{ge`al9>-Iy#f&%Ac zc!5QNB3&pApH7$+*4e>^&`seDc*d3b1Q%n+vYE7k(xJOOE)IbJe}0i#?1Eq>^44&G z7rCRlK&MJV*3T5bRgcF&H*3gqTPAE*dKKmgN&rr2ot+O z$$rkt!=bjuc}GfiJIDRPraW;*n8rRiBGS@Wga^3{H<|}{3uwmYNc^-kkiexdTFuTs z(xXfu%g|fSrAkTWZNz;U#$$|qYOKH`epePf1rzDKDyipcCSUGnl8|pltxEyC1>|-a z^kL^L;<2F?IB@Ri1Xm@rh~G3J19yhwtc;y1=48Jd z#59qn9?NzBteauqqb$u@R~xs1GjJ~@$w`w;Ax=ErtV&ZUk>u1R#|Cb%11d1#CT?Az zJBOSg^HoR%HHb&fO9P6JlKe`W{!s2}+-d^w7Cti)70OaGp!S3<$iUcH{Sx)5zqL&5 zGz+UpsaruukW?&wQIR&Qz*1K^&miaYb1YmTE+S1lQn$PmslXrL|;lWe$YYwa*#3?hNt|kC);l8Aq)vlaF ze@9O}KX3#Cu)S#c*Y*O^G{Ni{90_R+Lgb$GS$j$W*4Jb&xRwbmr;uPHE>cP8s9l&C ze;A?!BoOJSUH8B;@M?g6hMo-IEkHer7T_&F7Io><)Uvd@+4e|w$kGzht%#f&CCns& zs*Bo5;ax+JRBA{ZfdHl#R4gw)A#$LR z80pxJQ8h7h?Mtx?PQkHk3?Xx6!6VhNNYSnozPc!tJFpvQnD{18{TI@pl=!F=HWHRS z#~&t=wV(Q(L;^gt!EPZ{0Rh))tOzz9R8-0!T*wC`wPGB(i3w*hzK5Jjx*fVuN8~X1`E|>e!v1@Cp^vonv^Xr562!3GYEZYBAXq8g zqB)6A4T3aVGPmTf_%CkZ$j95NJgE{2KRAhDj$#S>F3Ur~W;_+ZE#xNKn8>@;@|_fy zZ+}ip^N&M)t~aArTh3C+SHPNmZr*8Tx{7big6-3S^q%a3rU!XMp|QKwA4xC?fZg?*L5zkfTV>G#UP4@jp8W2J(HhAM^) z3VCeeh9z4Nx}jTRas34sZkPW2Grqt#mFRO=bJcog!pbt`P&TVzhS*;#ZvR0~up8>+ z$cPtq5pJ95*7Z;p>aH6^M?h#XyhHOtsbp`fK^144;P3h(!R$mpyA;f`HJ4FxxnwF@ zgNMCBwxB6qFDBPS%oRRQ7Oe^}zleu-j`ToC82xGLTfQDid7mHRH9v!DGZW^iGON#| zSkKME$9^S+oq`-6UT{;Ab0^}8j=wdKwX>+o&i(tFK?{ z$H(&Huai1LHN3iR|x0^o&E4zos z&h?e0VjJ&^h3q@8rV<(NGQ$l+hb{f>nwvCCUH>Y95lmhc1DlVHN?z`o+m9x?h7xl4 z#i|rx)8gCAd4_U3=F1bX#~Uyn~ueW*4v?@x&Qx2YHnRsBKh17^Y(1{WsB-n_dHv?9YJT@tbJbSWbl25p684q2nwVptuTd45I@;M; zomRdm;nlQxt}!>w2*(0;DEnrgJ#8#r5R=Y)H>cWlMkb^zRuou zuNAeyQq8KkxvO3q*2Og_LyNb^Em!@(xL=A6wac1y4t-dLZ3nhTt+l^)-o3g$8?)vY zX_YP*>#DfN*Ul|I%mKjlryG8>mA9uaLe$~z+|Pp^Ny97t^_{L>ZFR;IkU6jBO23h_ zrK7XkN8opM;zmvkS66)9wq5|t{w8M57V{Be1G9$l zmyBR>`$}ZKz1f?cYfmSiZakwCWb4PB{KYNY48i44-Ws>a1>>*tUpg;~4+SH$>rY-E zJ@BKuS9!MXg|8C&Ji$$n&Jve24R?;R)Q^?l*?V8t*o4kGq{gml54C^e+f= zuGEHij`-q8HvqSQSE{l%?!2_Xa;GT{-X1rOUP_L6?7lWSA602h`?j|Y>iWKJCn*l2 z+a@QEvb|at?hOoc40^sDEE^K=t$)>4JnzD~Mf&{lU(rnef_$Rgz?_`qbZ@8Secne# z-p`%+#Ej2aeAzgs`@xhy(z@-7Tv4}ujl*+}9|UoM(B@yX*6_-ivsAk*oeAH&b687o z?jey)n3W~Jz2`b$SXjLL<@Eb>H@io2Ct?eOj=TW@BCwJnhg!Q1++e5r)2*$OuSRk| zdF``FZRdmT+RLm9Xv0+wF^1In_;Xoawi1m&qfPfV#_A%xrqZXC;L`qM#gKuv14+Fv zCGMb2$j(9QBQ~CZ6Vjy34+wt?A>9UX{M=;POo3}kZstV6a@edj13qpNT%g{*_s~Fq zQL<_H@<_Tv%d+=CATKR>xSXprYn$}CXD?soyQ9c`Kb;!ak^mzmV~NiQc3G|Zr!|E& zxe)J!U~12c9TNe4X_E;@UR31w`QfXjX&X=Cdb!ailXj}`;qm56&YjBMs^1aa^xp*Z z1Tq-bBijIeg23s^#R}rgN>$rR+YJGr_4a4VW;j-t@EZKn-ItM;d=hNHt)FuxaOwB6 z=-E(ru)ClZU6M|}foh6UW^@omU0~ZxXEVhk3y%ODk^H-->js*_1{K8Uk&6ai9-X~A zp?yPrxb9K;M_60eG!N`K^EslmJ8tY)&pp0_|Ay{|Ur#sR2F}h_t$kE>ws}jpv$yMV z&bWsXJ;{~I+TG+N6)w8+#8*cxj@*&g@}mwTn@u63GNatL52X)ve8y^@P)Pr^&o)MY zq+tF=Tusy+D>Y>^=PwU6wNW=becLLs;-!e6;Wm3+~LS?D9yF@>-QmyD>0{ zzZSPV#Q`Acy-xoT81a$#4KIDc`p+U8>Z#`K3P4g|qjJ=@@O_fil{{ZstC2)(Lm;@h zw!iweWuUL8-)js4X~@4>3HIr0`=$9OE5abp;D?r=QcpS&79WmWX_Gi}9zU&QlW<+R zcSR8(8&-@#GwPG4AF$nF4&k zs$J-(ZNgx83yquv58nk4zgw1%?@nX+Ch`?S`TDm*liYs=&7SaqH1n!YaLs0?xVkP^ zN*K;vqz|erCT{^TTj2bnqvvEFQJtLLlYR8m)-7s_wo8we_W%6mP}y9-Wt`HdR`FtAvvJYN z_pqM5%vNf@kWncw+96s-uHGq~IxZbZoxV97>Y1!JJMqB(bGe!eFYUa%&fs2^{%l&U z3yo^2XuIjQU1|n>ADF6j{w|aV+%AR6V%V5jo{`y^+n|N=6}sB8((Als3!j}N&!6yq zhwGD5Q#KV@wFdhX;T+KDpNd@gKEoJ2gnT;pcn0z|@4Gxcx8qH_EFmB%qK`64l(DcWZto;sOjz;IO7Qp0&$|i>#+Z{8Y>;}Xgr(ybZHQ` z6{DG3Y`{z#c2GuLI)LldSTfQjO`8;JVLgxj@%I|)H$7|OQ&{JCJNeGNz;AQ74Jnt& z3xE`^etpvkWaGp8v|P&$H69@(s4SY=Mi{)kY;t343zK=`qbqG1cGM%AQ3qxx@!k%7 zM!}tGA&MsP_X}-6&z`D4IuLPw%R-o)0^T*o!novfxrcM&{_7|#&31+tZ1BUy@<$-d z5!aPW9iI>QiFroU9z}~g@U3jxh^RpN)Qh(tmIC*Tnv_(a+%d-x~dT%Kz5r zJL3Jj(N~oD-y40y1?9hue$BlJFIUw*b!lqsso$u-OpXm>#%rSEE%U>JPjNSb14YVcE@)gwJo@!n5 z55Cxau2FDyjGRlgok>S=~A$Z|0S6EwNK0w3nx*Ns%)_Fsj5&{!(Xr;!&6odFLAh?3^k zW77lgbL}#a-4#v<&Cnv~l+??`GP-f}->FEl; z`HgMvxYdT)Iu7RCqQ#tHi5!#QeX668L~HF52j2Ub^$iNgbC2}_Du=1A92o7fyAb*1 z{r|1ZM_Sgqu=Ts`%F4U{Q99n|OV~i|%nM#Hs_B=o8i9iqw;V<+DY;zD#1nS?=1LrM z(Wh+~_5*lKP*&CeZnc;)7>%?9Z|M_HP@Je%N|81uDA(WAt3ntdzZ2jl2)V<#{yq&f zBIcTVR1{Jq%dk-SuF79wgp-BvnPVpP(ma=N=Q)=Q|Edtmr!GD$cq=^4f<~xXc{AZa@kg4=P%Y3fT z|5oPH!~R#9pVvG4?=oL0?4L6K$CA>&%Y0hAf69D8JL3Od<~taV{kJmz#`5%kmiext z|67^=#Pk19=J!1&{=3YN4=w(u%vX$!_*a>)ApK97UzbDnPnqu{`X6O}?C8JC{65M5 zYngxZRs6ro{D6f2TbbV@K=yx@`M*JRaChHUO?4~b?_|tBAM|5SM!S>HRF|}0*I+GC$W2Y@O&xb6M_e7B~#H(fJh z@e^`x@-#VXE7F=5YjCzrNKVMZ_RgdvZWmvs2A`ysH410#C6;Xxp292d#x-Zsn7PbgQ+Z7%v~pD*N-x{rVZ@|I~lJPS)4yV;KM$|&0UnH^`iqjN?{4X z7M9&|TB6S@7(IheGK)&wdsCf7eog+sOU|v^Z?8sB{ph%4%+a%U$RJ;nA7k?WlGFPY z%q!|D+UA9_x5W01CZ{P0*+4fLaalt)O`!#bv8e*XE41@FgWv%L{!F?1!VmPKPbOoI zZTfV$j)UlqLH#vfWQoBC{1>0}v z+bi2?>$ElkMBfp+YZfa$yT4>YLW%U;R%2mx;tj5xogZE{mR{Xn9=!m6b-E_+cB zhdZyymtpHE)lS5e94Y~D0#F&a##hIsDc#01d9bbWW0j_We3q^6H|t@BG+Mtqn#`r? z)VyvPOX=@d4u%y-4h--3FU>}eqoGgM;{B@p!p2{z)1a7YQs6>DUc!3SplH#Ir@pDr zfovajs(pzT0gDNKu655MpHgqdB5LD$TRC4&elHe|o?TuG9_co$YhM~R4{*eB>l>nf z3P2X8`n4g&bw$o#`6I;fo?Z>8o{=B=_)ETG;mh*?T*<6M)k@7mc$qSm!_@q>>eZuI z!jf*ZmVMQv2GXX+FZzMjVFg~`>Z>I>;ZM@a|BrFLi%6c3VE4`AAY>igbK?=I>aw%5 zpgi`(xIP=#fr+}CoM>w$X9%J012$d1R*R+(uC8m^UNk*nx&cI!-sbx6PM%$+UeBg( zzON$f)GEo;sxI55lNO~B>e&5c7o|8(d!E!4#aebUF^f(CUkp0Wd}cISz3ndySj&AjfIw@|n(5%0ifh zWkbPAbAiC4BFZ|wtLIe^^+5j}6d?pA z^h^MG>GTwV{%Pi!1T!jI3hdNVs1lVYcGStO{SDwQ!rJCsw+|P5G0l zhJiQG!}@U_+e)^{lyf}QV&yuSriQuU%!*Gp5zT5{U-w&TSE$n zHO`$MeK2oU6C0y#%$k+X_dAPfL%fWZ4Q*vErYaYw@2?jx4*Etn=jQ{q=a7)xj|?+< z-tl+0>GRomKB?)WWZ8x%M+-O22)*L~FkzU|(~~Zp6Z7WWpoWK`wNuYvvzN8nKRbO# z?xLlyU{@%4b5wEI6s(0cfhQC0_ux{ho|3;Bws|z0xkmO$@sWqw__bzQUFx3JnQecu zd}S4Naf#oDRoW>buYdn7!e`ve@Q7O?(ev>3O*tw_FcXLDHV6V zpkhp)4T|Yra)XP1?0y^^qJU3ezH!AXd$gG3*;_i^n!Y}F0`S^#W#E#MK=5(#;l}~< z8F%}RG37@~nLU|2PojnE<@q$O$Xf)=LuccZnjAOKeWE8@rRc$R&hQO>e%KV0Rs{T^ z2u1S^0VuGq+Ab1HW=7r^PKq8AD7lrV!tvhBGb$A=)5Y$>h~*EWjbFSeA>4jxy5f<( zX_n%rK55^^g57Z8Q6EB&Ea&iKs+nnOgAeVQz2RYE+FPK3&=Ehf<>3 zDd#e-?J1qeBq@t!FEsHq?ON26WWYr%QQIDMFity8^}A#nj$Vx{b;Cii6w9PT;XCt! zEsB+C=>=KPupFceSwtp5N(2n+2W29(g_k1Gr+KG5%-O(wF4pXTOD>sL=$WuI9Lx7_ zqh+y~3K2udtei%4CK+b|SYm)cKQY0ul#t|Sj~t>{zenbe2%$?rpbtG`&O?e4HhC|p zmKJ}ON!3rVK>4SGuQWUfXftsul`SDIU-le4{1A$#*ruF})fkV&P=7ZSTIO&vT8TwC z*2h1Um!ceSiiPno*f$k?Ig^Zhh05Sz5Y%RAb0#K3Ks^tSF(5lj@i3789a;eLOppyD zF<<&zjl@QZ$>q1q2oy3jEF75@`4ST_5E&LR`h4&!6oyoZobUsbM#lHues?g`MNKK< zb0`Zb_2E@C;U5|buoa~3oyA@_^?1UWi%Rh!q*_G!MlgF4^@UFn>kU0xH)w@1`Jy&i zzQ&Pi*tDiJ9H(U5)>@5q=mRhbYWb<7`-Ll8=BW#J z4;Nj6pB_(xSJPWj7Y|{GZ3H>=4pj~=4PJm8VfM&xhklUHPNNsXa)-0S<_n=21m*qO z3tgnsH4tgG07V37G>%I7+Xg}dO&*EVDOeN{iW1QuPM2g;ym^HH;ccQe($DVxW1>E+ zKb-G7KxTAt5=cS)F-Ya2%!PkyMbOI1mS)_WET60=us$QrU4)BHH0-XF+_p9gb=7(0dCwd936Oz5Pka1%Vw<{_YO_V&K(DK)8ZOog_a3S%WmuDg^ zSzw1hVf|$HN`CB^a%9Vo_201dyGuPK^5_{UH?QgV6QE+*Y@3UpC+e&53F5HGKJpB~s1 zXqgxIz6DvkEBFE^j&JVegRINPy9Uo)0(Bu0;(XTRW`tE z?HLC$n$Ub9>B5k(^E?xETq126weF$bKfH!B7HuYIP#^AVa@ejN9%K zMcPG-aDr&TSe)umS;uvm^fdM{=Y{Ii+%0+b1KUE*A|SUxe(IDqV^0Ytb`F!U&gybW zggSg{)K{t^cLN{^rD*m5B!O&cuVi0_D?m#8?qQE>H;VnK+ek>%Yk>A{f1+>54uu3e zLpsU&RMzDN_?XT)Mc|m-TkG_UkB!AtMcc|QtvGS^bV_P8|Ib>2j4*6q5E(mc5I=+t zrkg)dGX>a$)DvzO6Q&OaNOFZG9Sfu{#jrzw5bIDY1YGE9idRWk1SFmqaf`8mQ!X^$+oBHBD>0_!qMU7>4=xD>}N8zCx&P#quI6y zC7nxYVG#~z&T_5b;l$yGoF%C&EMy|Tp+FCOyCBj$%ZHHE;1y`HW&iO4CjS~6m-Bu9 zo@r<*NN?m_#@Nm$xOFi7q+?wNPW|1V&Y?4!SgsAaH6YMMJj%{#R z4RZ9ffKb2tyXx`TB`(c7t0~S!mKC>!8F;60s_&wzK8tK|h}!SeV5m%~RzmG;O81#Y zmY-~xZQm&pJy}N%&y272m@M~45x9nw$RypnM2M0ma$X|k7LiU-l|}QTMXv_tmCC6= zDvIfbCh^p+h0B4|&=M7e)I*&e%SBu$(ACrGV}4^0!)Q?yN8^$4WTwj;@LAa4ri93b z?&aY#u)}pc{gNqhs{W07+~!$U2B%TU0!)9fJRatb*2;o$}%OgT;69SAUC={9G+%YhwpX-DT5d$fI&U4RaCGU1PN~7c-mhWff&PB zB>90QAN8O>ct&!l3Fwt|F4yH9*n|O0hB%9@z&g|eO}jmW2(RC`$>;^k^1TJ=5i$j7 z?&glGrsLpYN_VY!jjw^5{`VStKIkL2(@B0G>jScpzc^c&CJ>A-BAR7VZ@ zn0MQNi#@EMZ3VFIDTpSHk5-!008&we7y@(TyzXh*tVPP;w4YFbQ$3)1S@&GM8 ziV|nk2`w<`NfRcAa5JL8i~L#QXh_u$AQ2#m!~^Ng&_d^Ok)U9QweyqU>L`X50p}OW z1-a9ZK+Q^4g~i6P^WwW6?YHgX)EV(OqLKQ_J+ zav_vCrer4-`U0}Oq=<-Uu($YxKTs>6a&blUs|`5csK-q2uM+jy)2kx9>422LRBhpt zB3#*V3K>e;CfRxm)MEF<34k>sBp?^#A@czqf}wsXz(ZJsf&?x6A%9`Ye543f>*VJY z8b|VW&yIKA8i{Pyj}GB@>Kb?~s_a25vpO3u)x~w_zS7|6e*%ug%bW+6~;xPu(w303}HkR#z%mpw+IR3LlaHJXdV}a36Hv% z=x`Aet+PI51y!h?P9e4^qIm^XDWqCN7EipmCoh1c8WOFOsiWj}@;e#ej5y^ZK$Tyt z>vVho&Eyk2it18PT!v=UUP-j)Sn`}hi5_zLPnJJF3B$y9WDbrrH5B^&k%;R|9~^6D zQdSBm?BLZHxmw%o`~Zf`Cin^6r9$37mubkE&`?QCWyhFEIa85&3}rl?Wwt#g9NWY0 z_ztd7>{ArJGQl=V&@W%MV`Oy=RGsQg7*c+Ob;v)D<}lNwPa%2S`#~7Zqwa)|&GUsC zN|fhJ8w#)K&mhu|ON)5%jG*j3f;||3hp0Bjr0I5@o4M7GFUjV2uotnKElQ+kVeUZw9SvI2k~Z@n;h} z-rT-&?+AA8a|4r$V($SKCG`^sBHFCU-r-=;7dUvNBI-RPwvndrrfeTeJhF_mHer>~ z__tOu9pTF{Wl!u1lgVEY0m`mT??u7Jl$e0Gg42k1@Hg8;_MI$k?N;ZK31Z4>zv$z> z`kS(dZ18|4>hL03W`3HZynf66B3YK!WUaat8icj9m9^SnH?q0U^--pcT6=FMLj?u( zcosJks_Xom{7U#=5dr4H?P3`qBDiI*E?*lmv``AKD;zZU)--bY_q=}i_;&f#2a~%I z*k4_`Sl5RGWw4|PO&kUSmBJh(ns`TrQmgGrDS3$j(VgP7)@eml| zls3cFTV%!j$VQ83#M7*V z|Imyw)_PP~S=o1Aa)N6^9ui z3B9{A3rc+!A{^IaLn<{PRzraTYNi(OxgaadGoYSA$CZlB(jc#2>?x%oHoIo(h5yb8 zFs?{s_D{R)bD&(8kQ29h4LPv}f$UWF27iqO+9pCHjpIHVgO>A(NLz8a!GmB>otg=_ ziz-U3I1o~J>Z!m6VNsQ`Eecd{E@fR)^S5MJ?dSB;gapB^Pm*J^zDuf8(oX`wIUYiT z@{DjQJ5-UJmXa*3MXeoYm*#rL`y*%l3FSbW0h~_HZ|WQ%T=8Q(|^tl$1V6u!Pt@NIz{19IuYj zN5Ur{nv?a3vSWhcQvWQzAY>A#{gxgws2qW-gVaMAXyr?t9nOeGeNk;&sN{AONymR_J$&9owl_5)g;-2e*^ZRt z7(i{+1sia`8DY8Uw_^bcyHV{20brdKyF{s@qCj&JMG6vDV4#iKMraw~u|g1s^{YwK zRzZ|&n(gF4oo2Z)LaA=CSteAI(NqzGMQb3TU}I{#hed0s`kj#Q;DAMGE&$=6NLOv9L7By*6RY^v>x4q~NdrZNaWm~aS)N7AV`|m9VK;x;^0tD_5QvXx3Fi7nm zy(7eWoIifWBs+74pTyidA<$5tg8@DXGkkv~;D};yjmSey4F*sKrP1P?lNN0ZUW(Fk zB~eDSY%StTHyLB-Q)>Yd@mN`S7et`-t*Dxz zp(-jXO*c;wOZ`>|FU^`M1<6tLP(&&WA)^V|;&z4=_UNega(0b^s1xdYF*2gA?)$Aw zM0NuoAJV+aOiQX3_^YFo;{w~5fs<5FE{Hmr2d5@Jlp}Ilb{t4Yl`97J_k2D~X>w~| zjN!mEKoV0-%O2Mc2~txGMt;7e12Kv%IkupZkPY?2>y*j%5oOL$Uvg?>&cTH5DuOh{ zrj-W7%&Tsk!EGKkdHuZb(ByOqyWsatcy@nPB`R7$lhDXlS1?liONxMi&B7OJ+4y3*r>a*$z^Z*c)BAtNl!k>jCdR1( zMpk1M!&-(}A_`k^KeCBcQ-?X)Au4TXg@V7lSqf~2XbfMSDexwk`ET5d#G{sS@+>rCQ`MzDa=c!W^7 zi5Ur}C*`OPKZ5(-MMfGGWwmNzQ`8zi5az;-nTGVr{a6y@SWk^5)Z#%FK+m$;dPN0K zuvG3PRMVmcYGK9(!-^EeBrf67e4S`VSIAUKErX;d>OxKb0hw@wq}Bs#J9b9MLPczB zI6{5{f{l$}f(JSMn^Q}~$ub`+>hZ~Cv9E|ohKZ0*Ia56hkc_LH{lOuLPbH=MEEKp#1xki>hYU|xWZ1$jga{$@Y5c6eq6m*dygG9*6KtZE zwDv~Zx#0>OT4$Gh;Q>&{>dKn}sQ$}i&Yxfr1%?ky?$|JM2vWZSxfowy$ljDTFxgbH z>+I{O<^_zQdpK6K!t1363EqMkC7AvIK}6U96TTt-p)o5D7A~EFNP;!5hW7P|=|zu8J_F8=xC-n8*&`r+@VWmC&^(6wk_gTpT5JH|G%OL`3QRJfP$xZaBqn( zX0Y*4?xr3nnI6H}v_hvm4|sR~7DX6$@m>J-C3MjTCWo{)2*B7!1C0pnt#;cD^eHh4 z13p~=L4d}>)b2PQtbl9Qgx8S{N7c`{9NLAK-ys%t$>@uqT)C0cC!2Uw>F5BT`uUL&8%)d;eef)KCe zFGyDNVIIm;x(xE4IGA}^ZY4025kH3KpOt1k3%jD??DplY@_U_3yYH3j2zb6yOj1!p z{ed7+b$HZ6CUto6Lc&0fbK=R2+3cQcVwJXs9f)!x3WJewnW~iW9_;tuo0AF6N(=(> zfeLd=76QYYv1l6jf&hir6QQ`2mVgv;i1&GbV-s~D2i2A05C=5awn?%-EAm{jUu_E# zyj!w2LwmdRSna*((E9VYX=dr^XX(|W_XgBAJN&;~U7Mrm7FOZE?5)kU;HGwL!bO^~ z({6C*W~%MClhzSTWL%A>7q-fhBmtmkwoRz+GTJ5G<)m&9{Bfn ztgNlQIvzbgaclGP*1fv0QflpeJe%?CT~{jYU8=vTZ@;FyS#_U^uI*RFKa9quq;LJS zUCGT+d;Qc*`?;6|cCI?vTOA#Jl5T0q3RS(NPe1qN*3Ojdk~ErDwQTmI-8M;3GBQAYy?R)=S6@JBM*p;dBeXbJ2lt9&8?fM7qi+|@Bkg)q&`pl$; zsk}w9*kILY6-w2z%LUI?-mczqKGTD&wzsykM)V3-kKRXHS7p=dw_Dg;S%2NuW*q*K zxRj8qr>kBWnKahbRg+e+BJS18`*eLZW3A{P{vF?)z0y?$lwKW8f8PJp#s9pjj_&%S zv;EpH_m4GK@|A(sy6>OSL3Hpam+TcX;7Z;M+vt)Wde?rI2#^B)LHvf6Zv3~ySJT{A zOKkxLXCcEsfBu?JKi6IRYd*cu4P4EU_ok&9QAxFS4r|g&wlGR7n7L{RP45u6fXL@z zlvvW~UVc^cRI1LhLbhKX`j)1SjEtRD;j21X+m`X06y(v_<8RS@b$Jz_P7K%MU-50N zZ+dn(d$lQlnP1dh7naXBAJ)RE_NtNcmp3LeCaoQ~&eX=8?$^6~Vt%CUT5zZG7cPeS z4%AWCPQ4-Mrf!HDR%Wm4UeDUAnQwDdGK@7{`@Gj=nfG_EZYBM6LF+9%{kdPhpd6Bi zUlPeHhv4n(mr0hIVnO<=Tq@qhl$zuywDM)WsvO@^2@=!d=#R>k8PEhx$w5Hou^(^{Owqh z&9L+rsq3L?)wm~s`<0pSs~^gKqn7C|%vP3NFX;gO?eF$3KGezPk46Spkvi_t78l^$ zA1jZeE8OQymwi^q7d9dJJ-+YPT~Fu#@(-tJ*{k|_D`QouQ?7q%Hm5F}8Qk!AxL&+& z7Sz4t2LQTs>pKQ^yVfplREHnes+)hrt5>h=6d%*?Uiv;xUDQAKY5P7;?XbVcBq`J_<#`gi#v`(-!x#d>V*>RhAsw1?0C{^IIw zs!DI={l`iyhK3hmknvM#hn%vcNQ}GB%WH_)%Pj+#kYp>)EyN7 z-SYExRYTw2`~6U+$D*f4P;T@1{wUi#s`1&@(^2iOAc&;D88Z#~54&dsyaNBLLX-F+WNuh-^SZ9k7k%a^V)u>j~f zT4CQy|3&rGm#|N5^zm^v_vIhlJ;?aewk!1|A~N^Swk{{an(Ps(9bZ{XDLvoJ-Pt)c z_6kK1*qt7KV$7y2Rz1p}*H$$t>kT99oz?0re{+Xf?tOYirHd~P50~4SonreZysI1C z-5Nh`{SRG+@|9fzg_SU7(u>xCiz@H$2YeNpj=cH9yi&Sl)urVCsLvA4+n#oACr{r_ z*ByLU5FIRL1$hncRPK2CvsOE{PN_#@+in7SUz^`X^|Gh;O@J9 zz+Uq?#y*?nt?+%r6-Xy8-O6l(Yoi&ge#fv_o$2=$_5XwredQQ-s*+mA_f9O@(|UO+ z(35Rp7dJ#Wj#_eP#RnNyL(p0Wk5_+lh?8K4Oh-LAJ*n3iY}hWf*YeDg)B!8%FO{d0 z=0T5^jM=DlA1bn0K=XEW_Uhx%fCl`zsQn@wH1egUU7zZ=sB_|%C#oK3vSUjI-IjM+ zB|8|H@&7Xr0fKBfiYTp419flucGn=18qc1Y#zdt@6v7T7JfWkfYJ7Ip4Q^YE@r?^K z9etWQwtYKBhw$uDi=VJ}uGu!ND}Gp<9GbN+$gbZM-gvxk?wmhg93QW*zFfPxDsOGk zRO_~GRyUteTnA59@02#R7B5VQiKhJaud4=AuJvDeTAfkSSQgPQ+KJzKD}1Z&QdRPV zhyQH)u-8vm{4@0=Y@q&)Ln*W9(B)n7pi6RQh z|3(qgUjKn2WMBU`D8jAbZxj(n^}k0E^|w&}h9cCnMgI*&pcf(kjUv(mK>r&Qq4T`| z(ci)G@EQkj1xRX&b1FO8#bvEpTz~pFWk`8GVF%FXR{bc?+a7#g$&1o2S68~|u6&kV z*|O)edN3wjy8j#dGU#ndlCcWPg-woW@zt~`bBtMfN>&B^&C$yaZ6^(S1&nG@tY zYQFboHkB=f9L6!ds#Tx%#Zwopd?~JltnoQpY~=-g92+_~;`YLYNdIYF_;a*-^1bBQ+efr3WNp8IqN}Q}Twq z%JmrL?qa+CYv-HbPwXFGVH8C%8CEj_r-|o$6!MgB$+GR6Nu5v6SwXfo$6ZWWvr&rj^(+ss;*A(+8*@rt2)1~FUWxuQ zB$s(d8fTJmKRyN*_CC7{-t&VXFbHWgjoCAe`7;Mdkf6%7__1N6ZF?gRqhtOu5eVlL z-RZ^xBrB5VsLe(kepyCTJh?R5Rz2A*MC%r5WQmzDMyhl>8sq%kC~rS(IsAH$N9Z^x~ZRo3T)WYv1GZk zGVQgkp52-MYID-;$@^SNZgVtS^7$>UEvN1FktD99<*dpVG?=w>5aQaAG8Z$Dt7*fH zJ>bDt4;8vRxv~4?oEo5l+#XND96C^ zWupfsejGRt509Y7+bFabR|a+`yyFy^yL&xdPkPY{BH5c&qa~bF71=9kohs=%9=~{h zO-31*He0h?x;|eLTO1iaFB3Zq^%N0)W!^`@!M$|OQTuH?ob1YHs(&q7P}Jx#V?Z%x z525TABZ@>R1PfsnuGzHoosjoeze?U%X8qZGM$9H^S4QyiIR=l6tq9z=u*Gn4F`0oX zHa_jsM<2>_-l(A$uIE3_FC~Q+wOvdWj7n6Bv+|GAFF;Z+DMu9>ob6}qT_ylm*zRCQ zE8q^}^0<&{K*+IpCof2Elwq#ytkhd%f|UjLmt!jN*{~RY?Kv%_^CchSq1x=dB)yKL zg#NfhrL#phW4uBwPGoy^!n;aJQ=62m$C-&LH#PTkWWmIz_Y%FyR8_dOrDv_DCktM$ zQAx{OCLiK)j$Zd*q%6NLT-k-RkFInhH(mI&TBGqvmf11MrjsK({OmFJBYFwRG%H)j zbDU|R&$CoJA@}_l0r16_Wj4y2H>$6!)WlRp=aXT+y<>fJe(g-$WlpyGGWp}9@VLGL z)PKmeKt6wjXrlLop8UH6LuT=E(0s`y`taAWNH^^ve;b*r$V!`6^RHG8n>BOX&2whk zMHpK?Zk##sk2g2_=5T+N)n8!0R^6BIJ*DN1mH1TIe_yg6EG{uT4bPyTjOb>{LP`1N z(Q$&dXSDpdN>aXsitOzqqx&Oo_UM{e;t0<_WRYE6&VH>y!@F4#KTRII-_ZA|No$QZ zJnF)hSAp)@V~($!l$rA5P%|?J&YN9HzPKnzHFwtNsYWMeay|M^M6)~W6I0}=-#P!#^%ay8%q2E%#@XurOTK;};^Q(<{Nrf}d!?tz!TU+&b%L4OHuG!v2e9ur)x4}<5w}`3eAMKRSS=GH zZNA-x;~Y=*RN_c*hqPQQN?Yl;->4in^T`A7OU#9dkle6lMI%?sSpE^(Ia&;}`*2$M-CK>$R)OEiGa|^o)wRt0N zHR{+0$)%$K_@=b{w-GZ?bj+?LNx70T<# zFKb!L)sWFkw{_WUW_0&i(K@ZADXF)w`*2%Q#(FMx(C<5cJvs|NcY&&-x*wxjV>?8A z1-7Sht>i!JM>ZgYOu=&n&f`FCsW((UTme<<{RPe!)_wrH&Nj(7n+g`DR= zoXe`7SmN%r44m_)`^K1J_nSD-PWnAgmP>P^h;cMu*?pW+L^MK)(lbPSY z|HPZA*5RqvUDv7RuL)t6vqZ@+3UcmroT=#bZ@IBO8=7D>l={(B2~XCu=0r&7*EgD-UajgO83(M# zu&@ByH>&v|maXbP45+G`ABc%Ha*y#*o6l@4h?#1?azKV# zx-LNuO4p;!3utHJwn@~pbi3uNTE<4oitlVhl?p7OU!%`-B$rMSjgt?EW=z>`ekehe zSWdsU!dzR-F80(gniX5l%w#wEIU20mnTzfZ)GUt9oYnv8cMa^Vu7<9!#K$@M+0Eg6 z#XCEtFJq^- zt+K8xA??Idz2r;aSMb z<5v7WBxuGxMV=g^N{qOoOfRhLjkq$OU>@D~i+~92qcI-=^<&W27#)KcafY>2NX1Sf zyo|_wfnZ=B-}dl=R%4^`Gw~`tmSnjvYd%ztu$7%+e2ItQ!QUiGAT121I&w`EL6b7b~~f>y9Zz~5gQP) zB|vA+_j$vBJSYYVkDD0z5m_rZ4Z@@p9CK!db05kV)C|-F%VXzz2HEi6C?K7@XxgEY zK56Em7T#;lqKe#U>ZMNZH1|-;tub#?!z?oAQUlF0Z&O7kn|G-}A3&SI8KC*m=NS-I&BYMW#zCt zdy0g2YEHD}lCc!cRSdAK1T1S+|CD2RmMgq`Fu1Tk;W#FWY zlh{E=V3Gw`H<9K_w!7X`S2=qk~1l88?estS{)LmVS~Tm#j~C=%)E zg(g5)e}AZ6XB0?L1%{%2n+R8iNW&nmN;ouVnR&9*!2uu0$r3gV2ztTnW$55p(ifbP zuXzoTAhJs3$O^*2`9W$-Vi6J=h6ICDm0=Ko1cMM23HbAG@Q}&`x zS84eaN~%<-MHfvVQ3ZQa3-PO4WK>`=?l{P4A53=+nPF^B600vDk z%f}l;2XRC)oOnNJlBUbzsJMakiG9is#8WePz^6STF*UQ zRc>yr{^s-La2vjz-JQB_4V!Pv%b~5Owr^qdTu{|jDE-~H9p=74^A#({clW63gL@uI z;a-Z?yWy?LLAOsMzPyyU%#8@|!VoshK_wG#7^ToZYx=1(w;YvSzi;9&_?T{-q z@az)UHg^U&2$7;CXbrS;CXcQLSVH&@tjVDc3aBGwFO@=A58ken_#4Q;mv>2OUBZND zs3{!=p2V$SW2B$Fj4a_>#3JRs{5E3<(tpB!=8^uo^Znk7?1Qg+zEt{g6n~|_?&t$= zE;%%S02euecymq^hrR#F0$HgmOy&A=U5sTvZdh`=*;*{2E9nD-Qgm)_rrUFY2ZZ`P z#2IWr3)(Y^4U{}D{JNsUkf^aa+-B->mvw^a+twk0I)%AVjdoBzrvx;ZRptO+1k1!~Q4AHBmBvzgHDrUEr2@0^@DS;Re10Z* z|464pPI1isM~=R+l|6*$XUldW+?+;su=oDWTMrTz>Rm}{g0F%I4^He1BQ;p^FK1k7 zPRT0B*A4=u20+S(3N{F-MrJ!#fE0tJZZ?SP!V|stDD^^hLL%_5 zg>BD@L+wKaT0(qRBSw1Vrb+Av9W*2LC4dLDc5?r+5lCgkcplIo)|rcD3|}JWXwlOG z_WKy9eXSF2g0*Qs3;i-Ol{yBcg%ec5)1#>O0f$Rx`O=@)vzGn&U0-!j%N4GYWf=f`6tO$!?}lf;CInTc_O$IOMPKxsjsl9p*8 zo-izQe|`YYXCY7!Z`)rE>D+2U$du(Zj^jLJqVxj-%^*mV6*WrWN23Y*QfR@*iWVKa z?=_{4d~RJ%A`TC_xG<&k>~D62KcyQ+uQ1`O!e>&k62g{8Jf_ zIm}l7moY{LB{$frdh9Dub-fsNidC~1u1G33M52hIE`0gV(`k6s4+2q{{j>&1Zw9#Q z%5lMy~knga1iWCC>|IP?SAcYuSAOB2&io# z#2a9I6i}GpMb{Xz@mk<-9q|b*P{HQx4#|_rJHA%38_r_^`e130$w%CL7}q=w4^TjQjFt#4^l^^v zbl0aIHm^;LhV2~yaQ99=v%J~9;&v{^vc|gTI3p4DG)(nLQQmceCJ{+#P#uoQglOH* z#5Qk>b7~S~NoQ*|Q{-d@Be^`h(|Ir_5}$hyK{yd-`wA*hg39@Xoaq}!$cw-R(!sSt zOA8kkL6jslA<#Q3bb=QGDJY8Y0ji=-4i-W!WU8oW4lxaBhfo+~CeS%0oSNuS#olLB z+A1K?p@#Xpbu2R+?eJ5ljx`R+XY8Kj<}qnhPLgoMrc_CDjv<+`^xQ}aSNsD@M8eG_ zkEw<3b7{LaU!Y+sCx8K0;jqebWMdKJD3TSi-C+W|(E;JJRR~z$jbjTNgi!!=srYWd zX-?pdKuJUR!G*~$MhIk-AfEn)G!SiS;LHG5UH-A=D6~+7t50t&Mnr`XVFN;@jYLf0 z9ikBeDZ4rqAQux3#)*$O2Xs0o;=XtX9?^+F5o)m*QighSHA@eRIk3>tmX%dk+-451y^6AVxz0&MHqbTPDW zKhbep8o|vr)KVwypPEuIn?h(E%UeTDB1qvFA|%cc5-D-SU-G0}y(5(((1Wmassr06 zyKJ%?@wf)f2F?YflS8bx0kNWdl--cwKmbRn;S))yHL2l6mxQNOub5LEDY6h%odg(P zOpK;Xhp-uG)M&jHs9{l$T41RdKLaZrNWjvEdhL$~x2roOpF5);l)-P zKbpc%*fI7xipmvrxwPg`u}LPD0H}^JP`Cz~1uwcEN?|C>Pjq#Vuxoh1SCyKZ&*L^K z57k3-#R!U({JQ`M>XSrI#Uglm4dq)EN#(M1$WzW^M!uy1<#J)bQ{KKtyu=AXJm@Pz z1WMXd3^B$2OHgT}V5iRP;3m`T@(K@0eKKTJfHQ;^!dXzRvKbJ^R zlO~eNj4z*HH~O707`TPSlb8}E|3|?fB^_0O0U3RE zJ$SFg9o2w?o}Lg8Bkm$xw81Q~GM+l20(M7zzLd?=b`W98*GCXh(lssh9e3;wJ``Aww;c-D`P`FE=zU-u3)}TE$nCMYdhR7 z)S`J6jDX?Sqt&m(A!%Wu^kq?$l}&=QhFD!!qLh;@jA*;n3KcO*NDE69VeiFK?mE-W zs}%R&%(_alN=U3v24t2c#o2Z7t=bNzscJTBwcAn4H*AfxyZt+t^FS=QW0&6ACJ+8R zoPgl4$FoIH&VquSCTPq*KZEpiOvYorJE~G6yl*f%za7WkVDNaeh!u8HGzX1si0Gxh_Rsa9rwl z@ndpePs{RdKQiHn4WA`M?fcX{d7Y&s$tf>l!WK^n>23jIT?=~-bq3wUM7s;>Vggg} z=bM%epg+x>ZURZLU?8@Qe05ZpYR;czf*N&sHVI9!F3x20vNUFA<@|jYXXh6<%*LI9 zhDo)RVbPj?xkO_foW?74YMpF>Et&+6@NL%hsJD|A`8uf0e41ICkGbVZG7Om+lN7et zqRc*P7AbN}*%|5-@vvcP=xGt;;SgnRR+4CH2H$`|=HdsVum0Y8Tf4)t#ScE!dwh+J z$|M){Cern|E1Oa)%O+dra4$$n&cj$;8nF`F>v0reCCQx1Y5V?AF?NTYz_P1ex$Bo` z(LGLZiyk}xaCoqV3qcg*|L_)<#hDtu*aF|6D>K3jX3bHCK(!oY_ySQ6Kkb5DI3 z=&`UmKtNd4KwrY*H%GIKNp)~B4XN1;Q|)&MAuxm}o|#{oO`k(bZPA3F)kf%^H7I7Q zvN-sUSYREZaO6Im=OHLD?{~qz%M~6#W|@iEpohqUv?>E3#ak~07C?4c3PT`+!=N19 z^umKCqVl|xAi|sy$z zNhdSbMorNVrAiSBZW}oy39{6HvH9HO1d41a2CmN&62-#%Hvs~eX0yW(mb@HRhf&~e zQ>9cFJ*AKiw<(gyG?T>$+;-0_2_ELg+9{Msa^&IZz8U4=-<=b-AC4M)xjB96CB@0c zEuE6aP$c4~Ac$V88MbE@S%6Y0eX?K)aVMk=+apQKOFblfvSJx|C!|d?G#T@YJuG~p zWD#j6q=t@__UcqsV<)5!mCWWA-!%jZ;}{<#4hUGH`H&92M)7 z%0Luvbdq2-E)3wPp5B6RHSg9aG%hHz81)B800`=WOB}7{Wv6P zsHVUHz7S?vsmO5%WN?+=M|=PVMFG)jv-cv1H4~Pil}t&I5jL$wJmO5I8GUNYKmXt;)|SYW@NmjyBYu{ws#Hyh$M-Lnd(38lq5LFm13#{+A&eq)ZOk>@pMe(v77)`5m1#>E5l5a#YOJNWIMu-+h7ER z`Y13PlL$eCt%$m@k!y=MdWyV~L3K#b8>w>zTpVi;Fe9oPsPF+<6q#*HR|G#fN;@p@ zjZMDI1#1vAvKOZ&UQh?rl#KZIbHQm$41hjb;?l%2fB`iPLy%HfLR2SB;YcAIsrd>q znyTQ$tqCavSzBMyt&Ft`LVt{M&8?ZS2O_#!D;%Q`0_)BJhQy_KB8mqyRu&}oT$w@+ z_?rhY3tbZy#1WOOKEFl*UC{|6^P60#5om)NfJ#lV6 zsBNb52~}H56;V2;3^t7OBl(UYIAUo{V(MjNU`!P}K+>GNVp;&{u!_A^T%|4wH54rmP#HrP705WDXf9@2Ak1LVBkja%C7ec^ zmVs*EXOk#ToBTExf@~5HQfx0o-HIDVu>F?NB?%St$OzFTi=V_|r=@76C5!T^h=%L} z~9QtOcx56NdCB9hK#tWN|8P?U;4DKoJk$?Z!s-oXzbeK3_9r6!H& zl+Yw&;{k{_wqsV6T6-9ogf*$GvjSQ=$q@9cx@}OX>I*IJJRt5cu?NQxK_cakM0exRDmh!L z$`tBm-L8lc3=<*GxKmwC10aUE2_96!?y&YliHGsM8XHjZb>>#pndiWviC?89KmV#B zD3%VG1T+6f4T0#d8UlXCU*_UijCbqXT)Y*vw6Ql{UIT)3=gxLw*g73r*lxgbkWAD9T#$*;KI7s*RGd_eF;pH)iaYk1Vt!GwO3i`o+r2nEkA0*P{?;EI87a-nncO)jhszsUvDcML(| zGF*sL7C)v=zOqBYKGWurGOfGk_h3g<2prg%j#GhU1a4$%AhKtH(D1|>4vjZpD@v>tO7f)zOi(ngGhh!JA}@(MS`N;39JrMd_~tAFr07P@p7xc)Ay=Zfc&vCUmxf&`!m8@h$`?Qc2E>V}e+Ala&AGuB74OVW1Vk=7frOR_eTlGpLDODgt$Y?3_Ekao145opvEC}u4p zjE`|UIv|TNSI0KQ*ck+39HN0nh89%2Zv?0+dA~ap zRzMM;xiPj|zYUhd)~mp;ONYbg>D>08h3C9UB67~EG5l$w{W!%vUb0Qo?UjQal1vfA z5(^p{%sF5}u6G!6T;3h3B!&YvTQO=5a=rfnF19ijo@LJgp}B(#Sd8hw zY!(91#|E1nFzUG1n9j~m<)Q22K{R>X%tl>Nc~vYuuH2-Csm+zJV#p;=o+p?{_tqWz za5U4H=(Q%SmBa~m#o>(gVk&A4`$ZZ(7a-Pc6NroO3F3q8d@I%?@w^ZUy*5e(cGzh` zgHD3Z2Ga&^ms!%8A`rKS6?`fE^eSqJ)@XG~+ip~mwBO}P1LwaerKzc-TEM?62&aEp z3s-m{<)DLK#fH73PB=Hzrlna!@o}Tl&LLba?2+T?f1HA&L1eP#+gX+Pc zX>=G2DV-|wnOSH7MmUh4Ff3whq#)Xoj(;@}Iwj#g6uB$m@2kHX2&XLVaPJK{ukF0` z=Gm(zZ+<;a_Tp`Qma-pRJ~!{%h6|lI4`TG2+e*HU3ybF2q>ZUtP z9d_v51}Pu3`=9mAIv-=9T{oA!zaaPO^=hB>da*v=KdaR*W@f%G+Wy85F9c;R_{!o~ zzoPxyo`ezy4sSLet0cYnOr8r|g_LU_TI=h!CYznRceZ-y&#Qm5U#!gLe=QSz`Elv!V()e1C^?rByY1ggOxjOJE0!K=*@}T;xU@c&&+=XynOm>@wO65LZSKUYZ7bIN zEbVSqTPWpwQN7Z`BjIFu<0k!Kt)3p8M*XsC!s~ybLq@*zd@pLPnV(X7b18*MlWMp1 z;(5$>;*Ghm_#1dc*KMd%r?D@~BU?gxS$ei^hxUYjXLh;;`OH|B4!iiUI6OYY4dv^j zOuTQk2qkk(tMV=N^vt9)hkmCEUZvmA{D51y2xXcn;Z3;o$pih9w%xqo)UET@J4h~n zUiR()8r&e)*kQFVkKbzh2#$)jCNUvo-fg{qV=R;l~-*P8klJHGOJ- z+1e&1>YN>Kce(2vic_j;KH$#7+}h|89~#)zzi>zXp7;whTDP>TR#v3xlHTgcikE#m zx3=D{&+W`&eBf-M!X6{V5>3V_OFZJr|$C>Pz+udbWomfqr**ZJj&F|gl z=BT@+Rc9aDv}UF+kzm;HWwJKh`!VTTtp1qQUoFMFQSxYCr&-hA?Y$7b?#ZViv!5C* zz+b%9+3u-7Sap|=i^G540jO$~JDUBfu}Av~1JBOAm^iqi#oLv;#z92DkBqy)VO;*x z>#T}mw#@;syg~xI$L)F}E-aQ{V0<(y&%(W05ZNeV|6%zR%d+R^DIx ztLz3WTgMfXi;EZ*oMa5b%=(g5kBd!;FJ9bjvvQT?$bl`wJ12lk@BoR+!yvEjw9 z7LFBUa*%^b^?LH_d~I06MA_c4;OKL~JbRd;nS^jNq+8NPG*D)xRjtPb0(8QEUdlc%jGO1C}@5gQZ{ z%CEHzR}Ay~v^OecR;i*ais!q7r{rebC%vmb$8eN0>fGQ0^$O`GGKJ?u2|_5Oc95r8 zbYQ*cSBi|+&$FLg*RHg!`%*zASAQ;RPCL--ECOI8YjVJX?*}`acW9NMh@_Kh4qGtb zHs@qm18HRHXqz!4!hzbOSKIkjY)iJL?Qn5hK8_`YLF>^{Mey-X9(J@b%1PV^!Xhr^pZ1pW z!Lv3|Z0~v*2L{Vw)z{h*9)cIUWNjqV%a&AhNj>RA)!$zk;C(3hG^CQ3?j5eJukTUC z3IgEC^#?$@f+F>|Y$fU^B>1p{$2sqJ@eRlQpC566Kuxwt^1@r%@kl5jMb#2<+w1Y1 z3owiZ)?9JBdx9akPSYBrWKgq)GwM@Rol|&V-h-F#uUN_E>V z#XmQ{2clj zJ@jSv{;_ZiA3NlB^tsV8uM_?c3*FZ7yW~bpDccx+zRqZpvDC`^b>5@YsjQfhL*p@= z>~4afIS^KSJzdiL&+}oZOXf0{c~8iF45G$k6`fvgT(sB%k%;}@m*GeCvKi#IX)V*f ztXJcoINU8esva)YWZMeeONug6)`)F1w=A*|^}0-WUljGGcj<&HMxsUYbnN@|>Nt{J zRjb@o4yOH=U+4#=sl1(X3$PC?L++%RZyN56A(gK5JRMxIyy;-7f zQ!+}#*}g1pYO7`ON0crUz89bHEXQ?*meMs5BokC)pLR%Q1gZ9T9EA(>=%uIqVk~-k zN^I6xYFv{;-Guy__D53@89jCa$~ZII%G*y*f`C%)X?%I4pd2$`ozhv-vOFKYe5xy) zQ9gV3t#VQ{npPj5d>!n89(0+Q-Taa z5|dOovsofaOy&iAxIb)*E`}&zhK~q!k}gyd6?MELF;%&V^C+y`Qof(55=0cAn6C%$ z6JsgIh&iu11D5!%zvkzcdG~++PJ8t0oM~(>y2V7ryOBW7d|PTJp-oSaN%8cqU!mJ0 zIyFJ3JB1=q6ep{US9L7aOzkwoa@a&A?%r}e3!kzaC98k&{feQKCRu`*27T5tF z(6FTQK#w0Ar%ZS5{Amsy4dsd4+_p00(6@|D?KI27l0Tqd@PF#0>H^onJHO;54F0g~ zh)-ax0<9Z`en?Tai0=s^Gmi85L9&DQ`Sn|T&F_4xepY2e!`6u5+ta1Tr#ri4b-TNd zdBJaW*VK=51rM_X-Z-C^#XPj(2kq`EE>%>%+t0QO4_Vxdfie9@h?o7ZJ@;ZB7a~Py z@5Np-UU&NT;!BLp*$yp9a|rwU@A^D=!mo#6-!T|9_gnJK_0gq_tM>keB-D`?#;CIfSBKU$c65tNi-KXr+Wzhebm=)I>;{i)E;hDX10Dhq}ketg=$ zlO6cE@D~@W-e}_MhP7WM0)bjj65@2w9+0OIXZ}0iQl7Jl6W-ApgzI@~qeX|Cq z7OfH{j!%Z;XC~#Z>E(bd-h1LAQEUe0=eTSm9Bk$#1$~A^ zc|)-gd5>#Z?N4%o?qv3LSRqQz+%_T%HZunmA@@tp6A=_3!+6{%X zB?3CPgN0{L6(p9|RZp7UiJ~(itjn{S6q`Lg;ybbpCto(+YeV;G`e5Y%E1S1l88yWR zwaD_ryW$!jq@kbC!?Zi$8~jp~ zFcJA2X$HVUkd}G9Pb^>fX*06^_6@)`?=V$LLYD+X?ooR+*E^h2yOPaLVIpy^{06E9XxTvY+LhXgN@qToCR|?9e|=o}5{oy51X)v2#1TqvpevpCdZuxCb=survg8+t0WM2!6>! zU5??eI!<;;#>c8SE+H2ndfZOV4>yJW7BcJkrx&jPyX1Nnc2c%;?M3SRO6 zAf44>CJyliC#U;UJ$r4XT3eG!D1>^(bI#`-w76e8QLbn{}Ju!svFa$dW)3-f?C4WDIdh4tKq<(B`L%{s3tLx&iqz0iT( zj8C0~gB*?WT4Vcfl!m4W1DnaUQ>FY3F-5OjkHd-Qm=vV#dt91=SGZa1j+W>)NZygp zpoBD=h3kZ`F=k|u%mTS%&{ZWrUvs;>Km6Ob6}DNnY`tQhS+2mWdYPr89`JJE)A-Ow z{M3)E^FU?6mB{$^u(o5ypLFuak8{o(&J1rO*-^4|ME?i=oSGa&5#PKys+ls9K26zP zz9+US-Nu)LUDI{68#QG#UVr=hAVl&~a8hw^aOQS!xfqroTXVIfiXUPQMAis0h^O5? zqd#4!h*DtolDl+f0`ge4A8~Tl^c)SUw|+k*EuZ6u@t!%t?n^*d=74{N1?Uzp;!2^# zI16$;itplbez>RJ^0*f|q@e3kzPC$lvHP9G4Lyx9o-(J^3kKIN=$0O~hueh(ZxD0= zn(dwEXGvF;+8Dt314MrZR9~)C4ARk)_h&ksi>2(a#qk| zTG&l#kA+JSTxTa&$hVpblu;3nSq&L`&pl(~I`LpdA)y)HOZkcO+-y#vUVnJuob5tu ziMsH8eAMP56M4;MJMrz8&72YBm`xu1@_I`W`*Wo@1P@SAj@>){&y2~%4vH}{%Xn2BM9JecN%UnLWRBe zXXVHnN_zrvzmm($dXIFbjwUT2l&g-uQ(2VO^fHfp8pZY+OO;yNCj!p7f89qscDHSi zn1Ixw%_9I!wWjZHh>i}Xo(Ma%t;wr&nU3NGc$pOt(?^_L#KuG-Ql*f(JpgX2s`qD# zw0$-Ky;%~A)o(Zjg=yNzGz{%TJnB`kU2OAA?YkiERAUom#EU{C%!)oyh)LEa4(Mv- zaId#+@S+MXerg%Px!YSXryP zxqxtMrYP-$gXJxuHspiR54}on11e$*lk4-g<-bHc4%o`ABn64<$(?xfm$Mb z*2UM}*~=acIv*}lDJicrcbR4PVlBSquyrX7*@x^B2g4R#jMO#fsE3tDo1+#n6Awor zMenLDZ`{j<>x2kIR_V`AK23OH=ST{9NRSs!ZZx>9B-kZil8$O^a`3Gc8Jq3yYm(|# zzBexZ4U{badZ^1N%j;;Bo{JVwma;*~(k+#v8Wk#R@T5Aj+yBf&bnL_l=1e}S22#dz zYL&}|%PcVrk_K=JVcGdhuL%sIaq$P~dE+OaNvjEn8GTjQfK4)C6Z(rOHTvgwe;a%( z9r}z=Sv&1T7K);nL$Mgd@E<$E3|M4)m!J@pd=l$5+macfMYKgr*}ql{jd7DcrDRS^ zLtkjFw&bJEDaM7^U7UJ`m0rZ;Hf6Gr$o)MojxP0v9?_vE{miq}*~Y<75L>K(A=F+j zIOhV11ng8s6x^)1?DNix$WXDWK@o|@pvK^5p;<6KFgX3tjNfBSxllhS?n^=YqgU{z zKV1do^nqoTMrzYsb1j@efw{gIz3^1ETGwC3^XQiItRrmdMUFTI@m$Mn4GiUcYhAif z&+??Q`RyzV9GVV}OZr(;%WU=BrdiG+G@d+b_9%Tm;E!tu%>WNGguW_0 z4ZBp6@Agt1aW`m*u210YSUrj+*=iU05!QT38&u_Gz**hm5S2+8dP13*f}$5ru&Ez3 z8u4o^7B!1yWl{D(Lr>W?DXtU5<~WF`9OIu*{oKQ~vY^9xi}=wVoa2YZEe6>diwEz| zDBcxDW$n)`-8)%Z1hssfBdiLZ7WZOGY7SeGXti{ma?E3z76lp^fJK&Ktot;3?i-N- zPnT|n+WvQ0x(UXfsJnzL&6Mxl7THSVO_|oBQAj4`&{S$+S&u0{;4O5O1K*}NbFj)0 zm)uQ4amr6Ao3t`=&aF?cfba@oc(;E9EyoIkLt z5(SZMAlfnjK4tEJR#(J`L#g zS_kO4J?VGJ8bhz!#N_F7z-6wuf5_SR8t{HIW8o%n;F9+tX6wkm*2&+Uf7w-z8NS(Y zZl4J`aKDn{fB8-09mNis@@d!wNBqn$2u($uDill!R2pdbfl7lnEbt-@6)2fPh^QSE z7Eo!>1_mk(dWmlDA$VY)O-2TiK41cyJUJoYFf2kv^ROuB8we#|&nEMHU+u4X?sW_# zUw00+29#Sh{*?yyHQ;>8*nifdyu?X^}ZWd%T~fkc=+GhY4#C^ca3^f9r*JR&CJZ}?~=fK1nk&@Kp*zkU6F!}R3m zx_q5+S@FDyV$N~=cUK;RI((NB!?HK$oYyh*b&0Z+6B)D#M+A#aKiRCz-UgReX*Z=m zETiNV&l2;t8)^_j?%ID_3?v|nf$^;9XhvTpX>EPD$(-}n_irq>-exI+aoV}SM_gQ$ z4YD`{8g+fR_B^g-W>Uzhik;hgio|I(TEM5i9I18+)|D7gtQ_hRNT!mKoZjY^$s~~y zU6h^MukyEuj?cQ!Fyb6ZZbrbLDPwIzNCN$0eWD7bLA&q3@X6qXp-2avMHjvWH9B&3 zL7QmF#Odx$^;m6|@=&6m5rghm5Y}TQJzQ~Sf*w8?x}BF+SW$usKS5jwd$WLWeAR7r zi%9gZVE)O#H3hW|WE2wnHz}zyG%W4pO6MA6!W$EO6p-)E4Vo;%WS_PbPGt)(;JqP* zDcD)5{AV$ot-Jhs7MBHC48+h{aAr5lq!#S|QiI6iYvm3thzO#3MC#adHt4~7L{wfp_qpGssH6F4&bKn>nQg8`# zI}6w2gKCzVEE%0c7H_U!a*o(&mONoGqt_A@QK$elt~L|M%-Jrtm^ptkDN`YKP(zmX zFE)^=#(}Efoj+@wlMXzRAeHLg(T<>sniDtTKF5!-6aU9Chy_`EZ^mEHHp|9g3NM#k zFtK8$(!B@QUrpxA&ynEUcVb00n4U5soJ?#&V2p;;5End%rDRj3pf-#gk<0+`67dt{KHrJfpnIf|5BCJ0$r_xA(RO=rCS<6CQdAoq4^?v_eG*Y z{~LTUp+tcktLcf-lrKCc$6*qM|>=iGISn6GJzmO|3V5Dl{W}!Uf+OfP-6c$lrvRJ0kw=vq&;5Xaykxja>w9 z_Xm0`G6jm~B^d^u&8dV%En)zwb>XKOjd)>PKV?i@V~}=`eMJsmbx3&25y@)B3)Am!zeo<+|@~w{ZIE$&O3iM~C zeu=6yA~mN_(P3i?ZkEQ1VJ#Z;#;C+BSt31_9;pF)$vRQuuMf;b3@Sro%ARi)cLm@u zlfj|z+F>*HIFB`inFWZ#vAw*r^=4qpnQRUL)lAm+TVJuVn^6OTr(&@@Evi>l$Fwl`Mm^^8IZV5&|=T%tQRWMo?VA-O7 zP?J$RuSt$jDkYl6HnH)B#Na_$s{ErFqJGV(q205fm;{AnPB#@4gyY#8n%$xz-g2Wh z75pM(MMGRr$*vbXWBr58*U<*$d#0H=yD{X)#5IJ|J(wmf%t+B}6{#vojS8|Esv>h( zsBF5X%OnB8gbLN79vg4%*5M-Vq&d(Lkk}=Rn~a&s(3>1L1sm~h*%S#d8y21(1sqezw;2F&|NW*DE30n^<-Kn2oVv|=s-LJXvP3N zk)DH_API$|o|tP=9&>MvOc74_b>W1L2~;1HWW~nVM9E<|L`AwL?Y^PA2oAl2rHn7Y ztm?;cBiyl-KP0KQQ8thhH-QC_YwOxlMrmuBN-V2-4@@8Mq-L}A{-8+2E?xtVI|x!q zjF{KW&;iF>0K(J2NK)i*kC~){`h(K@7y;MRX62pXB8wb6F=~BdhzL#G6X8?@7D;&6 zm!w5zrDrbtE!?)2d;92~eZ8<=^6P&A!u`Jh!JxNN1v;yNE>tvh(twk)K&_Ag4i5|;ZCEKZbu?+pQ$z6a!s{^2784){UdI-)AM z{R&SzlqwB=`9ByUIT$aRFAduTNav( z|J)oJFaMz#0%^`m2ONr{bJr3zxMf=-aId#F6v~L#fdnUnD`whHKSBd@(7`fJ!lFDvjH5R9B!H{=JZjSR9G# zJS!dG?G>mZhyBWrymYYwi+-azCt~FZ5*i@$9vGqG*ItYxvD|yc$rW}V8>A@*y}Hbq zCZ&#!d6e12j|GLq4%$8a#ihCYV~3!s*QdLL;(*x`UR8HJq}6C^?7;J^MLt13K=MY3Y2|2rFg!`H;hH&|9}N)N5^zo{pp8WeLQSTTq34o#IDW1Ro=?_jjSjCOpeorc^^@X3fs}X-+ zjV|Ju+;|>}u8DVO`-MrxeM45UuknsvR3(Cgx=V|$RbUx$lh)V%lDbUm7MsPs}MjeYTlPQSyUD8+(qqbK&GZ0Z)^j~~X z2R5R78SqLiZ5nnYSLY#bHd+m(<HX9m zRm(&gDh2UamgZfD9__SQ#r>Nh5tswQ8R`hgVr#@4OMlRlOQPX^RaE`s#Ha-qZ*IoK zB|0Vlyqb^}w5@jfFFm*rCZP;91f>T{jkYpWX`bZe)_)U|BNN7ctXF$7TlJGtoG$`? z$;{$~)~)YDbT*H8h&5xufY&$PX=0ljB`DSvbyN}cvHGSzm#YOyO||l; z9z$V73(meVuKDiK>d2-9EjPo@{Dfn7sfb6pBZTgjLZS*6_#KBE`v;9F=5$pEj8%1N z8YD9mrd67Vt6X`ha)WWIG8lsy?+4}?rq&%ak(O5<2b1QP$%I~}F@-OgGm-XZ$oIyY z^MP?<7i$x-z{A-1DlS5Xx*X|0%LQQ;79k`Z)3gF=i&RXOluyjb(_cgz3e?Vm6tMR< zaNQ(B8TB!5&WEUiFVLru7Kb#Oz!a+3VHpq$%6<{dsj(wtSk(*5ckwY(hhC9K zgC|cpDUxBc=a50H)7f#Di=Hm4-?33I(q%Oky=2k%*O^i%b(3W&+&7P`$#17e+L_fU z^A(UdUb&T#r;e#R9>$HIU0q%blj4=)7mldo=n}saVM?Cpn6{UdSi{h&zHsA<@@Hp! zcgK`hQ@&4r;>0)h&d&J3-C`szf4}&Il|`zXoe?@()^AW%NsyB)Jms@K5 zL%*8#Joz`d6YXYC|&0 zJ(-eP_!F)0wSNLP~{wzw0+_8JzvvvP|pZ59BZohC^pcLD`t-m=KT2~QV+ z5!I5e9DazPp=+sAfuvlmh=fGWU$xAr4$kn%CGQTeXkYuVU6z$5c!xuFu zp;Qj!le5Y@EsJZ*WP`6u!%zjdEN_%_1S>O0mHzbVE|H0Uv3Rb((PtwYOK%fH`!DLo+Y9eR@U?BGC8ZFg6ZMA1h^X zViC-gmX#w=B|JI0leuW52#Lz#kOE6feB#oK3XZC^Klw_@+847oRlW1t%s3bmOQ!>c zO&pzja}Q7EL^2E4ixn>ifncjbEguS`Gguj#aiNW9WcKXqW(Bl&p7NMJ#86(_6+DK?XP0)jxf)ods33~E~!uq129|%Z0B+($9!3!pi5lC9* zpq3R#TBL~R3y@PUmyy?*QOZ=)*l(S!zQNWt(87?dsz3_odr68-4;-i|QvwwhFT zsj%xqzL$oS%6;7e4)SnQ6nWjMI-GP6I@OqE#d2nJ9aEB+yVYDn(mD;1IN{iN5Nh~e zvA~V9OQz!|B_oU$J=1=BFNd@0v2xIT|M*3kr%TU)J_Nf)N=Cc38*?FL9mDlj&Xg=( zEUqldm@N02fLD~Eo0=>qq5%lq0?RW~Tf1TY1Il3ZoajYX@i z`dhrk;0++1LBsk#I>TV547)ElWn?V`*#pHBV|fL+pUGZdH!BuDK&U+%lT7r`IfOJX z8o3w(l5EnsZ+s4-Ce9~U?*|y1DR~nK!Xc+0YqxOOK6#&c^Gb#G)!iiQ0X+skUg@`q zpmH*IN~J3pa($MP&hH?e;fYN)-Rq95WrJbFT#ixuJ458ze|Ux@zpRCDUrsm-u)^Ub zbNmn@lV%8GN$JBJ7;(7{tQ*2VZrnLRy->;<^k{t7;)P11sT}2)Hk1UIzv8VVjsEcr z0(d_Y@s4YNvJ|bpQ3ukoceO&%-Sc$3W%2YNo!`lrSA^K~8Dc6{|FtRrnvzAhvr|pTyu>rU6_0n$NFLsy4r;ajlp}&@9ab zbZZj~B8P(DCop(d9!$1A*m#uH*ColWE~OSfF07Sr)v+JzrQW7&yBN#pjozYMnNH8` zyxXJ%JUlw4EVrcYu9t@xbp=aV%Sn(DUXKha;!PAbVbxC+Z%zzrc5X&P*2vfJ&hJP8 z@Pl|1jG?l?4%$?pg0+NH*{rmc#{;Y$vCQelEK`kX+sR7BnFGIAULmuC=W{BNFN z;}TJ9kn{iX47y=v|9A$O9uUtU)r3>DgW961fZp2=z3NG}VOGUx-%{wKO3JwD5!~q+ z2Ok>#Dy!l>6fEaxev|VR6C!E%5p`OiTHMnd7OKdH_k`khhJYCRYVwA*`38nZFLZv2 z)q7-$mK1DQr1_-{7Hf)C#8}VNXLg_0f-NCf)dj*V&H!vib6`+0%5-*<7jsq zeOEbB6SK6@1&em3eBzkLTT4Z=qZ*9^8*4tK=KCXkSt>l;01>uXvb4#6G3;`*^Vpkj zubXoEdOO)iwDwZY^>BXIckK}YT4Xy<*k|XV>|=T5>ha`)_u=5df1F`S@%j4j5zwm} zJ3gSGb@06J-JcmZEcZPR_Vdl5JsYr5{V*e<*E0um*|NYK=k}NM=WM+8r{GR+jY{31 z*T666ih0NP?SQPqRUYPLd*$nQn!o|?wr!sWo2TnnP&B~91G;j2k6Snh$z1eTAhOP7 z`B+;=1VAJVIR31mK7CHy3R#6$Y+L-<-|fOMH+$**?Y_UVfq180OCaDwJ?8E8GBDzD zx(?8TTXx`tEPL%a+Fg-LF7%=PB@9L#Iyw!cn%2n8z!>u#-Q)};UVK8q5b~_&& zr@dxgn@h@1p`v-L!5_PfzS!*BlQXHZ@b!3iWPW-Ia4ad6CUAAx#l|NP3uCOSzWvQ1 ze%6gqGc&X;JJTwzNI7)r_dFL?c@NKvx<-on2SJ>nrmY_sJaug52NiD|4qe0Z`-$^# zA!ssbmZ_A*8yp#P?C57`;KMAf76nYV64YzoYZCtTeq6FUY<_pMJ$|?2AMj)G|L&MI zJi9V8bXmi{;n(hz<7Sg#s8s(U>?LrX_Q3x9;LfGjL*0~VutOI>v?_x7ljr9l`<|0Q zK;0Wx+vH@ellS!&U)Q(d!kXF_q~Gx#?aaw{O`O_Gq!@wz!5|0X9QFO&SJlE_8yjsp zR|Rk9lT&AAOS^Y_gXm|NZqL=e`&W4ZJuz&iK4x>iua(6>M>+HAq5D-d`k@j5X$+TF z`Wmifs$+rr0xBzTrGx&nRRiQdu*XZ9*i$Pr`!>yM8wwx78%xnAyMqfKgI9Z3gI6oA z9d9LWdhxpwpJ+a164)$&iDNGzf57?LV0;_?v8WsFS;XRdfo>0H& zB6*@_R-1oI;rp`{&xy>8Q7ndEXO}NUeYI^Y|*72?u(HTvK;cH9Gq z=^0cbiz932|vMNBGq;i#WrNP``3>d@<{#Un20y#>Q9ew z>iAUea^I;HzU0ln$JTON^j}>xyUhT5?fBpz7*aZH-K1t>N;2>3>)hVBoK649LsB`> z_}ML2yNWLCWqEI`qw7_1U$Zjvax`jw*$TKnx%s%gn0beFBsSdo+&gjN z)3L|#Pw{Gpi2gtI0~h$2_3`^mt3pvnr*2x$Y>KT}k6kKLO5Q-NyzRzB|At-qdBgSg z1DVIRGEPcI8M9;WW>>e@*U`G`{4Yczj|K2@W!o8D_adOB=mS(Uv8I-*ro;VqWg5;s z?bNG28g5r2JH74>4m?vEE_%Bp1Mknu|1O`nD)QhESYTLSU|?`yy6!-O+NjoNcVsZI zW=$|KT+pNc`()~3ZtQBVVJ&HHVeMe;YVGL2Z1c_0;r}0mfhb}0=%p{g#Z8m literal 0 HcmV?d00001 diff --git a/Solutions/Snowflake/Package/createUiDefinition.json b/Solutions/Snowflake/Package/createUiDefinition.json index 1e5fa138723..bf86b82d5f0 100644 --- a/Solutions/Snowflake/Package/createUiDefinition.json +++ b/Solutions/Snowflake/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Snowflake/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Snowflake CCF data connector provides the capability to ingest Snowflake [Login History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/login_history), [Query History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/query_history), [User-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_users), [Role-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_roles), [Load History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/load_history), [Materialized View Refresh History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/materialized_view_refresh_history), [Roles Logs](https://docs.snowflake.com/en/sql-reference/account-usage/roles), [Tables Logs](https://docs.snowflake.com/en/sql-reference/account-usage/tables), [Table Storage Metrics Logs](https://docs.snowflake.com/en/sql-reference/account-usage/table_storage_metrics), [Users Logs](https://docs.snowflake.com/en/sql-reference/account-usage/users) into Microsoft Sentinel using the Snowflake SQL API. Refer to [Snowflake SQL API documentation](https://docs.snowflake.com/en/developer-guide/sql-api/reference) for more information. \n\n **Underlying Microsoft Technologies used:** \n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n • [Microsoft Sentinel Codeless Connector Framework](https://aka.ms/Sentinel-CCP_Platform)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Snowflake/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Snowflake CCF data connector provides the capability to ingest Snowflake [Login History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/login_history), [Query History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/query_history), [User-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_users), [Role-Grant Logs](https://docs.snowflake.com/en/sql-reference/account-usage/grants_to_roles), [Load History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/load_history), [Materialized View Refresh History Logs](https://docs.snowflake.com/en/sql-reference/account-usage/materialized_view_refresh_history), [Roles Logs](https://docs.snowflake.com/en/sql-reference/account-usage/roles), [Tables Logs](https://docs.snowflake.com/en/sql-reference/account-usage/tables), [Table Storage Metrics Logs](https://docs.snowflake.com/en/sql-reference/account-usage/table_storage_metrics), [Users Logs](https://docs.snowflake.com/en/sql-reference/account-usage/users) into Microsoft Sentinel using the Snowflake SQL API. Refer to [Snowflake SQL API documentation](https://docs.snowflake.com/en/developer-guide/sql-api/reference) for more information. \n\n **Underlying Microsoft Technologies used:** \n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n • [Microsoft Sentinel Codeless Connector Framework](https://aka.ms/Sentinel-CCP_Platform)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **XDR Detections:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,6 +51,54 @@ } ], "steps": [ + { + "name": "contentSelection", + "label": "Content selection", + "elements": [ + { + "name": "DeployAnalyticsRule", + "type": "Microsoft.Common.CheckBox", + "label": "DeployAnalyticsRule", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + }, + { + "name": "DeployWorkbook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWorkbook", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + }, + { + "name": "DeployDataConnector", + "type": "Microsoft.Common.CheckBox", + "label": "DeployDataConnector", + "defaultValue": true, + "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + }, + { + "name": "DeployCustomDetection", + "type": "Microsoft.Common.CheckBox", + "label": "DeployCustomDetection", + "defaultValue": false, + "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + }, + { + "name": "DeployHuntingQuery", + "type": "Microsoft.Common.CheckBox", + "label": "DeployHuntingQuery", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + }, + { + "name": "DeployParser", + "type": "Microsoft.Common.CheckBox", + "label": "DeployParser", + "defaultValue": true, + "toolTip": "Deploy the parsers and their registrations carried by this solution." + } + ] + }, { "name": "dataconnectors", "label": "Data Connectors", @@ -453,7 +501,13 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]" + "workspace": "[basics('workspace')]", + "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", + "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", + "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]", + "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]", + "DeployHuntingQuery": "[steps('contentSelection').DeployHuntingQuery]", + "DeployParser": "[steps('contentSelection').DeployParser]" } } } diff --git a/Solutions/Snowflake/Package/mainTemplate.json b/Solutions/Snowflake/Package/mainTemplate.json index c42fe606959..1074f0b70a9 100644 --- a/Solutions/Snowflake/Package/mainTemplate.json +++ b/Solutions/Snowflake/Package/mainTemplate.json @@ -49,87 +49,129 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + }, + "DeployParser": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the parsers and their registrations carried by this solution." + } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Snowflake", - "_solutionVersion": "3.2.0", + "_solutionVersion": "3.2.2", "solutionId": "azuresentinel.azure-sentinel-solution-snowflake", "_solutionId": "[variables('solutionId')]", "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.2", + "analyticRuleVersion1": "3.2.1", "_analyticRulecontentId1": "09b8dfc7-87b0-4215-b34b-bab363d685cb", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '09b8dfc7-87b0-4215-b34b-bab363d685cb')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('09b8dfc7-87b0-4215-b34b-bab363d685cb')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','09b8dfc7-87b0-4215-b34b-bab363d685cb','-', '1.0.2')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','09b8dfc7-87b0-4215-b34b-bab363d685cb','-', '3.2.1')))]" }, "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.1", + "analyticRuleVersion2": "3.2.1", "_analyticRulecontentId2": "1376f5e5-855a-4f88-8591-19eba4575a0f", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1376f5e5-855a-4f88-8591-19eba4575a0f')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1376f5e5-855a-4f88-8591-19eba4575a0f')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1376f5e5-855a-4f88-8591-19eba4575a0f','-', '1.0.1')))]" + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1376f5e5-855a-4f88-8591-19eba4575a0f','-', '3.2.1')))]" }, "analyticRuleObject3": { - "analyticRuleVersion3": "1.0.3", + "analyticRuleVersion3": "3.2.1", "_analyticRulecontentId3": "5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]", "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8','-', '1.0.3')))]" + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8','-', '3.2.1')))]" }, "analyticRuleObject4": { - "analyticRuleVersion4": "1.0.2", + "analyticRuleVersion4": "3.2.1", "_analyticRulecontentId4": "e05cc333-d499-430f-907c-7f28a9e4d1b5", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e05cc333-d499-430f-907c-7f28a9e4d1b5')]", "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e05cc333-d499-430f-907c-7f28a9e4d1b5')))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e05cc333-d499-430f-907c-7f28a9e4d1b5','-', '1.0.2')))]" + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e05cc333-d499-430f-907c-7f28a9e4d1b5','-', '3.2.1')))]" }, "analyticRuleObject5": { - "analyticRuleVersion5": "1.0.2", + "analyticRuleVersion5": "3.2.1", "_analyticRulecontentId5": "b7d22407-1391-4256-b09a-414a9719443c", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b7d22407-1391-4256-b09a-414a9719443c')]", "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b7d22407-1391-4256-b09a-414a9719443c')))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b7d22407-1391-4256-b09a-414a9719443c','-', '1.0.2')))]" + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b7d22407-1391-4256-b09a-414a9719443c','-', '3.2.1')))]" }, "analyticRuleObject6": { - "analyticRuleVersion6": "1.0.1", + "analyticRuleVersion6": "3.2.1", "_analyticRulecontentId6": "c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')]", "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c2f93727-e4b0-4cb9-8f80-f52ebbd96ece','-', '1.0.1')))]" + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c2f93727-e4b0-4cb9-8f80-f52ebbd96ece','-', '3.2.1')))]" }, "analyticRuleObject7": { - "analyticRuleVersion7": "1.0.1", + "analyticRuleVersion7": "3.2.1", "_analyticRulecontentId7": "627a4ff1-036b-4375-a9f9-288d5e1d7d37", "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '627a4ff1-036b-4375-a9f9-288d5e1d7d37')]", "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('627a4ff1-036b-4375-a9f9-288d5e1d7d37')))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','627a4ff1-036b-4375-a9f9-288d5e1d7d37','-', '1.0.1')))]" + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','627a4ff1-036b-4375-a9f9-288d5e1d7d37','-', '3.2.1')))]" }, "analyticRuleObject8": { - "analyticRuleVersion8": "1.0.1", + "analyticRuleVersion8": "3.2.1", "_analyticRulecontentId8": "f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')]", "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e','-', '1.0.1')))]" + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e','-', '3.2.1')))]" }, "analyticRuleObject9": { - "analyticRuleVersion9": "1.0.1", + "analyticRuleVersion9": "3.2.1", "_analyticRulecontentId9": "1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')]", "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1dd1d9e5-3ebf-43cb-be07-6082d5eabe79','-', '1.0.1')))]" + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1dd1d9e5-3ebf-43cb-be07-6082d5eabe79','-', '3.2.1')))]" }, "analyticRuleObject10": { - "analyticRuleVersion10": "1.0.1", + "analyticRuleVersion10": "3.2.1", "_analyticRulecontentId10": "5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')]", "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')))]", - "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5ed33eee-0ab6-4bf5-9e9b-6100db83d39a','-', '1.0.1')))]" + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5ed33eee-0ab6-4bf5-9e9b-6100db83d39a','-', '3.2.1')))]" }, "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.2.0", + "dataConnectorCCPVersion": "3.2.2", "_dataConnectorContentIdConnectorDefinition1": "SnowflakeConnector", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "SnowflakeConnectorConnections", @@ -211,7 +253,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeDiscoveryActivity_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeDiscoveryActivity_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -228,7 +270,7 @@ "description": "Detects possible discovery activity.", "displayName": "Snowflake - Possible discovery activity", "enabled": false, - "query": "let threshold = 20;\nSnowflake\n| where QueryType =~ 'SHOW'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 20;\nSnowflake\n| where QueryType =~ 'SHOW'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -253,13 +295,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -304,7 +346,8 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -315,7 +358,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeLongQueryProcessTime_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeLongQueryProcessTime_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -332,7 +375,7 @@ "description": "Detects query with abnormal proccess time.", "displayName": "Snowflake - Abnormal query process time", "enabled": false, - "query": "let threshold = 10000;\nSnowflake\n| where QueryTotalElapsedTime > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10000;\nSnowflake\n| where QueryTotalElapsedTime > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -357,13 +400,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -408,7 +451,8 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -419,7 +463,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeMultipleFailedQueries_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeMultipleFailedQueries_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -436,7 +480,7 @@ "description": "Detects multiple failed queries in short timeframe.", "displayName": "Snowflake - Multiple failed queries", "enabled": false, - "query": "let threshold = 50;\nSnowflake\n| where isnotempty(QueryExecutionStatus)\n| where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 50;\nSnowflake\n| where isnotempty(QueryExecutionStatus)\n| where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -462,13 +506,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -513,7 +557,8 @@ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -524,7 +569,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeMultipleLoginFailure_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeMultipleLoginFailure_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -541,7 +586,7 @@ "description": "Detects multiple login failures by user.", "displayName": "Snowflake - Multiple login failures by user", "enabled": false, - "query": "let threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -566,13 +611,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -617,7 +662,8 @@ "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -628,7 +674,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeMultipleLoginFailureFromIP_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeMultipleLoginFailureFromIP_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -645,7 +691,7 @@ "description": "Detects Mmltiple login failures from single IP.", "displayName": "Snowflake - Multiple login failures from single IP", "enabled": false, - "query": "let threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\nSnowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -670,13 +716,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "IPCustomEntity" + "columnName": "IPCustomEntity", + "identifier": "Address" } - ] + ], + "entityType": "IP" } ] } @@ -721,7 +767,8 @@ "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -732,7 +779,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakePossibleDataDestruction_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakePossibleDataDestruction_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -749,7 +796,7 @@ "description": "Detects possible data destruction.", "displayName": "Snowflake - Possible data destraction", "enabled": false, - "query": "let threshold = 10;\nSnowflake\n| where QueryType =~ 'DROP'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\nSnowflake\n| where QueryType =~ 'DROP'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -774,13 +821,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -825,7 +872,8 @@ "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -836,7 +884,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakePrivilegesDiscovery_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakePrivilegesDiscovery_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -853,7 +901,7 @@ "description": "Detects possible privileges discovery activity.", "displayName": "Snowflake - Possible privileges discovery activity", "enabled": false, - "query": "Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nSnowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -878,13 +926,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -929,7 +977,8 @@ "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -940,7 +989,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeQueryOnSensitiveTable_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeQueryOnSensitiveTable_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -957,7 +1006,7 @@ "description": "Detects query on sensitive or restricted table.", "displayName": "Snowflake - Query on sensitive or restricted table", "enabled": false, - "query": "let r_tbl = dynamic(['table_name']);\nSnowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet r_tbl = dynamic(['table_name']);\nSnowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -982,13 +1031,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -1033,7 +1082,8 @@ "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1044,7 +1094,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUnusualQuery_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeUnusualQuery_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1061,7 +1111,7 @@ "description": "Detects unusual query.", "displayName": "Snowflake - Unusual query", "enabled": false, - "query": "Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity = TargetUsername\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nSnowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity = TargetUsername\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -1086,13 +1136,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -1137,7 +1187,8 @@ "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1148,7 +1199,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUserAddAdminPrivileges_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "SnowflakeUserAddAdminPrivileges_AnalyticalRules Analytics Rule with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1165,7 +1216,7 @@ "description": "Detects when user asigned admin privileges.", "displayName": "Snowflake - User granted admin privileges", "enabled": false, - "query": "let adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\nSnowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n| extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n| where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr\n", + "query": "let Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\nSnowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n| extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n| where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -1190,13 +1241,13 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "identifier": "Name", - "columnName": "AccountCustomEntity" + "columnName": "AccountCustomEntity", + "identifier": "Name" } - ] + ], + "entityType": "Account" } ] } @@ -1241,7 +1292,8 @@ "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1615,7 +1667,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", @@ -4259,7 +4312,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", @@ -4615,7 +4669,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", @@ -4650,7 +4705,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5371,7 +5427,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5382,7 +5439,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeAdminSources_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeAdminSources_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -5456,7 +5513,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5467,7 +5525,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeDeletedDatabases_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeDeletedDatabases_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -5541,7 +5599,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5552,7 +5611,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeDeletedTables_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeDeletedTables_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -5626,7 +5685,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5637,7 +5697,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeDormantUser_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeDormantUser_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -5711,7 +5771,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5722,7 +5783,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeFailedLogins_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeFailedLogins_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -5796,7 +5857,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5807,7 +5869,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeHighCreditConsumingQueries_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeHighCreditConsumingQueries_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -5881,7 +5943,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5892,7 +5955,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeTimeConsumingQueries_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeTimeConsumingQueries_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -5966,7 +6029,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5977,7 +6041,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUnknownQueryType_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeUnknownQueryType_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -6051,7 +6115,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -6062,7 +6127,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUnusedAdmins_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeUnusedAdmins_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -6136,7 +6201,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -6147,7 +6213,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SnowflakeUserSources_HuntingQueries Hunting Query with template version 3.2.0", + "description": "SnowflakeUserSources_HuntingQueries Hunting Query with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", @@ -6221,7 +6287,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", "version": "1.0.0" - } + }, + "condition": "[parameters('DeployHuntingQuery')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -6232,7 +6299,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Snowflake Data Parser with template version 3.2.0", + "description": "Snowflake Data Parser with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -6302,7 +6369,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '2.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '2.0.0')))]", "version": "[variables('parserObject1').parserVersion1]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -6323,7 +6391,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -6353,7 +6422,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -6364,7 +6434,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Snowflake Workbook with template version 3.2.0", + "description": "Snowflake Workbook with template version 3.2.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -6441,19 +6511,20 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - } + }, + "condition": "[parameters('DeployWorkbook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.2.0", + "version": "3.2.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Snowflake", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Snowflake CCF data connector provides the capability to ingest Snowflake Login History Logs, Query History Logs, User-Grant Logs, Role-Grant Logs, Load History Logs, Materialized View Refresh History Logs, Roles Logs, Tables Logs, Table Storage Metrics Logs, Users Logs into Microsoft Sentinel using the Snowflake SQL API. Refer to Snowflake SQL API documentation for more information.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n

• Microsoft Sentinel Codeless Connector Framework

\n

Data Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Snowflake CCF data connector provides the capability to ingest Snowflake Login History Logs, Query History Logs, User-Grant Logs, Role-Grant Logs, Load History Logs, Materialized View Refresh History Logs, Roles Logs, Tables Logs, Table Storage Metrics Logs, Users Logs into Microsoft Sentinel using the Snowflake SQL API. Refer to Snowflake SQL API documentation for more information.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n

• Microsoft Sentinel Codeless Connector Framework

\n

Data Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 10, XDR Detections: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -6592,6 +6663,56 @@ "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", "version": "[variables('workbookVersion1')]" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "version": "3.2.1" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "version": "3.2.1" } ] }, @@ -6606,6 +6727,2125 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible discovery activity", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 20;\n__xdr_inline_Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb', 'xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible discovery activity.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1526" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible discovery activity", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects possible discovery activity.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible discovery activity", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 20;\n__xdr_inline_Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb', 'xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible discovery activity.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1526" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible discovery activity", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Possible discovery activity", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Abnormal query process time", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10000;\n__xdr_inline_Snowflake\n| where QueryTotalElapsedTime > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-1376f5e5-855a-4f88-8591-19eba4575a0f', 'xdr-1376f5e5-855a-4f88-8591-19eba4575a0f')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects query with abnormal proccess time.'", + "tactics": [ + { + "tactic": "Impact", + "techniques": [ + { + "technique": "T1499" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Abnormal query process time", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-1376f5e5-855a-4f88-8591-19eba4575a0f')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-1376f5e5-855a-4f88-8591-19eba4575a0f')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects query with abnormal proccess time.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Abnormal query process time", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10000;\n__xdr_inline_Snowflake\n| where QueryTotalElapsedTime > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-1376f5e5-855a-4f88-8591-19eba4575a0f', 'xdr-1376f5e5-855a-4f88-8591-19eba4575a0f')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects query with abnormal proccess time.'", + "tactics": [ + { + "tactic": "Impact", + "techniques": [ + { + "technique": "T1499" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Abnormal query process time", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Abnormal query process time", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1376f5e5-855a-4f88-8591-19eba4575a0f','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1376f5e5-855a-4f88-8591-19eba4575a0f','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1376f5e5-855a-4f88-8591-19eba4575a0f", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple failed queries", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 50;\n__xdr_inline_Snowflake\n| where isnotempty(QueryExecutionStatus)\n| where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8', 'xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects multiple failed queries in short timeframe.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1518" + }, + { + "technique": "T1082" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Multiple failed queries", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects multiple failed queries in short timeframe.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple failed queries", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 50;\n__xdr_inline_Snowflake\n| where isnotempty(QueryExecutionStatus)\n| where QueryExecutionStatus !~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8', 'xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects multiple failed queries in short timeframe.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1518" + }, + { + "technique": "T1082" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Multiple failed queries", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Multiple failed queries", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple login failures by user", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5', 'xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects multiple login failures by user.'", + "tactics": [ + { + "tactic": "InitialAccess", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Multiple login failures by user", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects multiple login failures by user.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple login failures by user", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5', 'xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects multiple login failures by user.'", + "tactics": [ + { + "tactic": "InitialAccess", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Multiple login failures by user", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Multiple login failures by user", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-b7d22407-1391-4256-b09a-414a9719443c", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple login failures from single IP", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr" + }, + "id": "[if(true(), 'xdr-b7d22407-1391-4256-b09a-414a9719443c', 'xdr-b7d22407-1391-4256-b09a-414a9719443c')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects Mmltiple login failures from single IP.'", + "tactics": [ + { + "tactic": "InitialAccess", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "ips": [ + { + "addressColumn": "IPCustomEntity", + "id": "[if(true(), 'ip1', 'ip1')]" + } + ] + }, + "title": "Snowflake - Multiple login failures from single IP", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-b7d22407-1391-4256-b09a-414a9719443c')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-b7d22407-1391-4256-b09a-414a9719443c')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects Mmltiple login failures from single IP.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Multiple login failures from single IP", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where EventType =~ 'LOGIN'\n| where LoginIsSuccess =~ 'No'\n| summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcDvcIpAddr" + }, + "id": "[if(true(), 'xdr-b7d22407-1391-4256-b09a-414a9719443c', 'xdr-b7d22407-1391-4256-b09a-414a9719443c')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects Mmltiple login failures from single IP.'", + "tactics": [ + { + "tactic": "InitialAccess", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "ips": [ + { + "addressColumn": "IPCustomEntity", + "id": "[if(true(), 'ip1', 'ip1')]" + } + ] + }, + "title": "Snowflake - Multiple login failures from single IP", + "severity": "high" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Multiple login failures from single IP", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b7d22407-1391-4256-b09a-414a9719443c','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-b7d22407-1391-4256-b09a-414a9719443c','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-b7d22407-1391-4256-b09a-414a9719443c", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible data destraction", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where QueryType =~ 'DROP'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece', 'xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible data destruction.'", + "tactics": [ + { + "tactic": "Impact", + "techniques": [ + { + "technique": "T1485" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible data destraction", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects possible data destruction.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible data destraction", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet threshold = 10;\n__xdr_inline_Snowflake\n| where QueryType =~ 'DROP'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| summarize count() by TargetUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece', 'xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible data destruction.'", + "tactics": [ + { + "tactic": "Impact", + "techniques": [ + { + "technique": "T1485" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible data destraction", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Possible data destraction", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible privileges discovery activity", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\n__xdr_inline_Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37', 'xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible privileges discovery activity.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1087" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible privileges discovery activity", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects possible privileges discovery activity.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Possible privileges discovery activity", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\n__xdr_inline_Snowflake\n| where QueryType =~ 'SHOW'\n| where QueryText has_all ('SHOW', 'ROLES')\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37', 'xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects possible privileges discovery activity.'", + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1087" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Possible privileges discovery activity", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Possible privileges discovery activity", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Query on sensitive or restricted table", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet r_tbl = dynamic(['table_name']);\n__xdr_inline_Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e', 'xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects query on sensitive or restricted table.'", + "tactics": [ + { + "tactic": "Collection", + "techniques": [ + { + "technique": "T1119" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Query on sensitive or restricted table", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects query on sensitive or restricted table.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Query on sensitive or restricted table", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet r_tbl = dynamic(['table_name']);\n__xdr_inline_Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| extend tbl = extract(@'(FROM|from)\\s(\\S+)\\s', 2, QueryText)\n| where tbl in~ (r_tbl)\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e', 'xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects query on sensitive or restricted table.'", + "tactics": [ + { + "tactic": "Collection", + "techniques": [ + { + "technique": "T1119" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Query on sensitive or restricted table", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Query on sensitive or restricted table", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Unusual query", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\n__xdr_inline_Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79', 'xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects unusual query.'", + "tactics": [ + { + "tactic": "Collection", + "techniques": [ + { + "technique": "T1119" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Unusual query", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects unusual query.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - Unusual query", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\n__xdr_inline_Snowflake\n| where QueryType =~ 'SELECT'\n| where QueryExecutionStatus =~ 'SUCCESS'\n| where QueryText startswith @'SELECT *'\n| extend AccountCustomEntity = TargetUsername" + }, + "id": "[if(true(), 'xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79', 'xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects unusual query.'", + "tactics": [ + { + "tactic": "Collection", + "techniques": [ + { + "technique": "T1119" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - Unusual query", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "contentKind": "CustomDetection", + "displayName": "Snowflake - Unusual query", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "Snowflake-CD-xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - User granted admin privileges", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\n__xdr_inline_Snowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n| extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n| where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr" + }, + "id": "[if(true(), 'xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a', 'xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects when user asigned admin privileges.'", + "tactics": [ + { + "tactic": "PrivilegeEscalation", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - User granted admin privileges", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "contentVersion": "3.2.1" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'Snowflake-CD-xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects when user asigned admin privileges.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "displayName": "Snowflake - User granted admin privileges", + "queryCondition": { + "queryText": "let __xdr_inline_Snowflake = view () {\nlet Snowflake_view = view () {\n Snowflake_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n EventStartTime = column_ifexists('START_TIME_t', ''),\n EventType = column_ifexists('EVENT_TYPE_s', ''),\n TargetUsername = column_ifexists('USER_NAME_s', ''),\n SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''),\n QueryType = column_ifexists('QUERY_TYPE_s', ''),\n QueryText = column_ifexists('QUERY_TEXT_s', ''),\n QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''),\n QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')),\n LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''),\n QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)),\n QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')),\n RoleName = column_ifexists('ROLE_NAME_s', '')\n | extend\n User = TargetUsername,\n EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t)\n};\nlet SnowflakeLogin_view = view () {\n SnowflakeLogin_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend Time = extractjson(\"$.EVENT_TIMESTAMP\", JsonString)\n | extend\n SrcDvcIpAddr = extractjson(\"$.CLIENT_IP\", JsonString),\n LoginClientPrivateLinkId = extractjson(\"$.CLIENT_PRIVATE_LINK_ID\", JsonString),\n LoginConnection = extractjson(\"$.CONNECTION\", JsonString),\n LoginErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n LoginErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n LoginEventId = extractjson(\"$.EVENT_ID\", JsonString),\n LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h,\n LoginEventType = extractjson(\"$.EVENT_TYPE\", JsonString),\n LoginFirstAuthenticationFactor = extractjson(\"$.FIRST_AUTHENTICATION_FACTOR\", JsonString),\n LoginIsSuccess = extractjson(\"$.IS_SUCCESS\", JsonString),\n LoginRelatedEventId = extractjson(\"$.RELATED_EVENT_ID\", JsonString),\n LoginReportedClientType = extractjson(\"$.REPORTED_CLIENT_TYPE\", JsonString),\n LoginReportedClientVersion = extractjson(\"$.REPORTED_CLIENT_VERSION\", JsonString),\n LoginSecondAuthenticationFactor = extractjson(\"$.SECOND_AUTHENTICATION_FACTOR\", JsonString),\n TargetUsername = extractjson(\"$.USER_NAME\", JsonString)\n | extend User = TargetUsername\n};\nlet SnowflakeUserGrant_view = view () {\nSnowflakeUserGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserRole = extractjson(\"$.ROLE\", JsonString),\n UserGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n UserGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n UserGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString)\n};\nlet SnowflakeMaterializedView_view = view () {\n SnowflakeMaterializedView_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n STime = extractjson(\"$.START_TIME\", JsonString),\n ETime = extractjson(\"$.END_TIME\", JsonString)\n | extend\n MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h,\n MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n MaterializedViewCreditsUsed = extractjson(\"$.CREDITS_USED\", JsonString),\n MaterializedViewTableId = extractjson(\"$.TABLE_ID\", JsonString),\n MaterializedViewTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n MaterializedViewSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n MaterializedViewSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n MaterializedViewDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n MaterializedViewDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString)\n};\nlet SnowflakeRoles_view = view () {\n SnowflakeRoles_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleId = extractjson(\"$.ROLE_ID\", JsonString),\n RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleName = extractjson(\"$.NAME\", JsonString),\n RoleComment = extractjson(\"$.COMMENT\", JsonString),\n RoleOwner = extractjson(\"$.OWNER\", JsonString),\n RoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n RoleDatabaseName = extractjson(\"$.ROLE_DATABASE_NAME\", JsonString),\n RoleInstanceId = extractjson(\"$.ROLE_INSTANCE_ID\", JsonString),\n OwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString)\n};\nlet SnowflakeRoleGrant_view = view () {\n SnowflakeRoleGrant_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n MTime = extractjson(\"$.MODIFIED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString)\n | extend\n RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h,\n RoleGrantPrivilege = extractjson(\"$.PRIVILEGE\", JsonString),\n RoleGrantGrantedOn = extractjson(\"$.GRANTED_ON\", JsonString),\n RoleGrantName = extractjson(\"$.NAME\", JsonString),\n RoleGrantTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n RoleGrantTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n RoleGrantGrantedTo = extractjson(\"$.GRANTED_TO\", JsonString),\n RoleGrantGranteeName = extractjson(\"$.GRANTEE_NAME\", JsonString),\n RoleGrantGrantOption = extractjson(\"$.GRANT_OPTION\", JsonString),\n RoleGrantGrantedBy = extractjson(\"$.GRANTED_BY\", JsonString),\n RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n RoleGrantGrantedByRoleType = extractjson(\"$.GRANTED_BY_ROLE_TYPE\", JsonString),\n RoleGrantObjectInstance = extractjson(\"$.OBJECT_INSTANCE\", JsonString)\n};\nlet SnowflakeLoad_view = view () {\n SnowflakeLoad_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend LTime = extractjson(\"$.LAST_LOAD_TIME\", JsonString)\n | extend\n LoadTableId = extractjson(\"$.TABLE_ID\", JsonString),\n LoadTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n LoadSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n LoadSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n LoadCatalogId = extractjson(\"$.CATALOG_ID\", JsonString),\n LoadCatalogName = extractjson(\"$.CATALOG_NAME\", JsonString),\n LoadFileName = extractjson(\"$.FILE_NAME\", JsonString),\n LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h,\n LoadStatus = extractjson(\"$.STATUS\", JsonString),\n LoadRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n LoadRowParsed = extractjson(\"$.ROW_PARSED\", JsonString),\n LoadFirstErrorMessage = extractjson(\"$.FIRST_ERROR_MESSAGE\", JsonString),\n LoadFirstErrorLineNumber = extractjson(\"$.FIRST_ERROR_LINE_NUMBER\", JsonString),\n LoadFirstErrorCharacterPosition = extractjson(\"$.FIRST_ERROR_CHARACTER_POSITION\", JsonString),\n LoadFirstErrorColName = extractjson(\"$.FIRST_ERROR_COL_NAME\", JsonString),\n LoadErrorCount = extractjson(\"$.ERROR_COUNT\", JsonString),\n LoadErrorLimit = extractjson(\"$.ERROR_LIMIT\", JsonString)\n};\nlet SnowflakeTableStorageMetrics_view = view () {\n SnowflakeTableStorageMetrics_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.TABLE_CREATED\", JsonString),\n TDTime = extractjson(\"$.TABLE_DROPPED\", JsonString),\n TFTime = extractjson(\"$.TABLE_ENTERED_FAILSAFE\", JsonString),\n SCTime = extractjson(\"$.SCHEMA_CREATED\", JsonString),\n SDTime = extractjson(\"$.SCHEMA_DROPPED\", JsonString),\n CCTime = extractjson(\"$.CATALOG_CREATED\", JsonString),\n CDTime = extractjson(\"$.CATALOG_DROPPED\", JsonString)\n | extend\n TableStorageMetricsId = extractjson(\"$.ID\", JsonString),\n TableStorageMetricsTableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableStorageMetricsTableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableStorageMetricsTableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableStorageMetricsTableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableStorageMetricsTableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableStorageMetricsCloneGroupId = extractjson(\"$.CLONE_GROUP_ID\", JsonString),\n TableStorageMetricsIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableStorageMetricsActiveBytes = extractjson(\"$.ACTIVE_BYTES\", JsonString),\n TableStorageMetricsTimeTravelBytes = extractjson(\"$.TIME_TRAVEL_BYTES\", JsonString),\n TableStorageMetricsFailsafeBytes = extractjson(\"$.FAILSAFE_BYTES\", JsonString),\n TableStorageMetricsRetainedForCloneBytes = extractjson(\"$.RETAINED_FOR_CLONE_BYTES\", JsonString),\n TableStorageMetricsDeleted = extractjson(\"$.DELETED\", JsonString),\n TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h,\n TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h,\n TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h,\n TableStorageMetricsComment = extractjson(\"$.COMMENT\", JsonString),\n TableStorageMetricsInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeTables_view = view () {\n SnowflakeTables_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n TCTime = extractjson(\"$.CREATED\", JsonString),\n LATime = extractjson(\"$.LAST_ALTERED\", JsonString),\n LDTime = extractjson(\"$.LAST_DDL\", JsonString),\n TDTime = extractjson(\"$.DELETED\", JsonString)\n | extend\n TableId = extractjson(\"$.TABLE_ID\", JsonString),\n TableName = extractjson(\"$.TABLE_NAME\", JsonString),\n TableSchemaId = extractjson(\"$.TABLE_SCHEMA_ID\", JsonString),\n TableSchema = extractjson(\"$.TABLE_SCHEMA\", JsonString),\n TableCatalogId = extractjson(\"$.TABLE_CATALOG_ID\", JsonString),\n TableCatalog = extractjson(\"$.TABLE_CATALOG\", JsonString),\n TableOwner = extractjson(\"$.TABLE_OWNER\", JsonString),\n TableType = extractjson(\"$.TABLE_TYPE\", JsonString),\n TableIsTransient = extractjson(\"$.IS_TRANSIENT\", JsonString),\n TableIsIceberg = extractjson(\"$.IS_ICEBERG\", JsonString),\n TableIsDynamic = extractjson(\"$.IS_DYNAMIC\", JsonString),\n TableIsHybrid = extractjson(\"$.IS_HYBRID\", JsonString),\n TableClusteringKey = extractjson(\"$.CLUSTERING_KEY\", JsonString),\n TableRowCount = extractjson(\"$.ROW_COUNT\", JsonString),\n TableBytes = extractjson(\"$.BYTES\", JsonString),\n TableRetentionTime = extractjson(\"$.RETENTION_TIME\", JsonString),\n TableSelfReferencingColumnName = extractjson(\"$.SELF_REFERENCING_COLUMN_NAME\", JsonString),\n TableReferenceGeneration = extractjson(\"$.REFERENCE_GENERATION\", JsonString),\n TableUserDefinedTypeCatalog = extractjson(\"$.USER_DEFINED_TYPE_CATALOG\", JsonString),\n TableUserDefinedTypeSchema = extractjson(\"$.USER_DEFINED_TYPE_SCHEMA\", JsonString),\n TableUserDefinedTypeName = extractjson(\"$.USER_DEFINED_TYPE_NAME\", JsonString),\n TableIsInsertableInto = extractjson(\"$.IS_INSERTABLE_INTO\", JsonString),\n TableIsTyped = extractjson(\"$.IS_TYPED\", JsonString),\n TableCommitAction = extractjson(\"$.COMMIT_ACTION\", JsonString),\n TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h,\n TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h,\n TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h,\n TableLastDDLBy = extractjson(\"$.LAST_DDL_BY\", JsonString),\n TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h,\n TableAutoClusteringOn = extractjson(\"$.AUTO_CLUSTERING_ON\", JsonString),\n TableComment = extractjson(\"$.COMMENT\", JsonString),\n TableOwnerRoleType = extractjson(\"$.OWNER_ROLE_TYPE\", JsonString),\n TableInstanceId = extractjson(\"$.INSTANCE_ID\", JsonString)\n};\nlet SnowflakeUsers_view = view () {\n SnowflakeUsers_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n CTime = extractjson(\"$.CREATED_ON\", JsonString),\n DTime = extractjson(\"$.DELETED_ON\", JsonString),\n BMTime = extractjson(\"$.BYPASS_MFA_UNTIL\", JsonString),\n LSLTime = extractjson(\"$.LAST_SUCCESS_LOGIN\", JsonString),\n ETime = extractjson(\"$.EXPIRES_AT\", JsonString),\n LUTime = extractjson(\"$.LOCKED_UNTIL_TIME\", JsonString),\n PLSTime = extractjson(\"$.PASSWORD_LAST_SET_TIME\", JsonString)\n | extend\n UserId = extractjson(\"$.USER_ID\", JsonString),\n UserName = extractjson(\"$.NAME\", JsonString),\n UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h,\n UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h,\n UserLoginName = extractjson(\"$.LOGIN_NAME\", JsonString),\n UserDisplayName = extractjson(\"$.DISPLAY_NAME\", JsonString),\n UserFirstName = extractjson(\"$.FIRST_NAME\", JsonString),\n UserLastName = extractjson(\"$.LAST_NAME\", JsonString),\n UserEmail = extractjson(\"$.EMAIL\", JsonString),\n UserMustChangePassword = extractjson(\"$.MUST_CHANGE_PASSWORD\", JsonString),\n UserHasPassword = extractjson(\"$.HAS_PASSWORD\", JsonString),\n UserComment = extractjson(\"$.COMMENT\", JsonString),\n UserDisabled = extractjson(\"$.DISABLED\", JsonString),\n UserSnowflakeLock = extractjson(\"$.SNOWFLAKE_LOCK\", JsonString),\n UserDefaultWarehouse = extractjson(\"$.DEFAULT_WAREHOUSE\", JsonString),\n UserDefaultNamespace = extractjson(\"$.DEFAULT_NAMESPACE\", JsonString),\n UserDefaultRole = extractjson(\"$.DEFAULT_ROLE\", JsonString),\n UserExtAuthnDuo = extractjson(\"$.EXT_AUTHN_DUO\", JsonString),\n UserExtAuthnUid = extractjson(\"$.EXT_AUTHN_UID\", JsonString),\n UserHasMFA = extractjson(\"$.HAS_MFA\", JsonString),\n UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h,\n UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h,\n UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h,\n UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h,\n UserHasRSAPublicKey = extractjson(\"$.HAS_RSA_PUBLIC_KEY\", JsonString),\n UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h,\n UserOwner = extractjson(\"$.OWNER\", JsonString),\n UserDefaultSecondaryRole = extractjson(\"$.DEFAULT_SECONDARY_ROLE\", JsonString),\n UserType = extractjson(\"$.TYPE\", JsonString),\n UserDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n UserDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n UserSchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n UserSchemaId = extractjson(\"$.SCHEMA_ID\", JsonString)\n};\nlet SnowflakeQuery_view = view () {\n SnowflakeQuery_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand OuterArray = todynamic(Data)\n | mv-expand innerArray = OuterArray\n | extend JsonString = tostring(innerArray)\n | extend\n QSTime = extractjson(\"$.START_TIME\", JsonString),\n QETime = extractjson(\"$.END_TIME\", JsonString),\n QueryTotalElapsedTime = toreal(extractjson(\"$.TOTAL_ELAPSED_TIME\", JsonString)),\n QueryExecutionTime = toreal(extractjson(\"$.EXECUTION_TIME\", JsonString))\n | extend\n QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h,\n QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h\n | extend\n QueryId = extractjson(\"$.QUERY_ID\", JsonString),\n QueryText = extractjson(\"$.QUERY_TEXT\", JsonString),\n QueryDatabaseId = extractjson(\"$.DATABASE_ID\", JsonString),\n QueryDatabaseName = extractjson(\"$.DATABASE_NAME\", JsonString),\n QuerySchemaId = extractjson(\"$.SCHEMA_ID\", JsonString),\n QuerySchemaName = extractjson(\"$.SCHEMA_NAME\", JsonString),\n QueryType = extractjson(\"$.QUERY_TYPE\", JsonString),\n QuerySessionId = extractjson(\"$.SESSION_ID\", JsonString),\n QueryUserName = extractjson(\"$.USER_NAME\", JsonString),\n QueryRoleName = extractjson(\"$.ROLE_NAME\", JsonString),\n QueryWarehouseId = extractjson(\"$.WAREHOUSE_ID\", JsonString),\n QueryWarehouseName = extractjson(\"$.WAREHOUSE_NAME\", JsonString),\n QueryWarehouseSize = extractjson(\"$.WAREHOUSE_SIZE\", JsonString),\n QueryWarehouseType = extractjson(\"$.WAREHOUSE_TYPE\", JsonString),\n QueryClusterNumber = extractjson(\"$.CLUSTER_NUMBER\", JsonString),\n QueryTag = extractjson(\"$.TAG\", JsonString),\n QueryBytesScanned = extractjson(\"$.BYTES_SCANNED\", JsonString),\n QueryPercentageScannedFromCache = extractjson(\"$.PERCENTAGE_SCANNED_FROM_CACHE\", JsonString),\n QueryBytesWritten = extractjson(\"$.BYTES_WRITTEN\", JsonString),\n QueryBytesWrittenToResult = extractjson(\"$.BYTES_WRITTEN_TO_RESULT\", JsonString),\n QueryBytesReadFromResult = extractjson(\"$.BYTES_READ_FROM_RESULT\", JsonString),\n QueryRowsProduced = extractjson(\"$.ROWS_PRODUCED\", JsonString),\n QueryRowsInserted = extractjson(\"$.ROWS_INSERTED\", JsonString),\n QueryRowsUpdated = extractjson(\"$.ROWS_UPDATED\", JsonString),\n QueryRowsDeleted = extractjson(\"$.ROWS_DELETED\", JsonString),\n QueryRowsUnloaded = extractjson(\"$.ROWS_UNLOADED\", JsonString),\n QueryBytesDeleted = extractjson(\"$.BYTES_DELETED\", JsonString),\n QueryQueuedProvisioningTime = extractjson(\"$.PROVISIONING_TIME\", JsonString),\n QueryQueuedRepairTime = extractjson(\"$.QUEUED_REPAIR_TIME\", JsonString),\n QueryQueuedOverloadTime = extractjson(\"$.QUEUED_OVERLOAD_TIME\", JsonString),\n QueryTransactionBlockedTime = extractjson(\"$.TRANSACTION_BLOCKED_TIME\", JsonString),\n QueryOutboundDataTransferCloud = extractjson(\"$.OUTBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryOutboundDataTransferRegion = extractjson(\"$.OUTBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryOutboundDataTransferBytes = extractjson(\"$.OUTBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryInboundDataTransferCloud = extractjson(\"$.INBOUND_DATA_TRANSFER_CLOUD\", JsonString),\n QueryInboundDataTransferRegion = extractjson(\"$.INBOUND_DATA_TRANSFER_REGION\", JsonString),\n QueryInboundDataTransferBytes = extractjson(\"$.INBOUND_DATA_TRANSFER_BYTES\", JsonString),\n QueryPartitionsScanned = extractjson(\"$.PARTITIONS_SCANNED\", JsonString),\n QueryPartitionsTotal = extractjson(\"$.PARTITIONS_TOTAL\", JsonString),\n QueryBytesSpilledToLocalStorage = extractjson(\"$.BYTES_SPILLED_TO_LOCAL_STORAGE\", JsonString),\n QueryBytesSpilledToRemoteStorage = extractjson(\"$.BYTES_SPILLED_TO_REMOTE_STORAGE\", JsonString),\n QueryBytesSentOverTheNetwork = extractjson(\"$.BYTES_SENT_OVER_THE_NETWORK\", JsonString),\n QueryCompilationTime = extractjson(\"$.COMPILATION_TIME\", JsonString),\n QueryExecutionStatus = extractjson(\"$.EXECUTION_STATUS\", JsonString),\n QueryErrorCode = extractjson(\"$.ERROR_CODE\", JsonString),\n QueryErrorMessage = extractjson(\"$.ERROR_MESSAGE\", JsonString),\n QueryListExternalFilesTime = extractjson(\"$.LIST_EXTERNAL_FILES_TIME\", JsonString),\n QueryCreditsUsedCloudServices = iff(isempty(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString)), toreal(0), toreal(extractjson(\"$.CREDITS_USED_CLOUD_SERVICES\", JsonString))),\n QueryReleaseVersion = extractjson(\"$.RELEASE_VERSION\", JsonString),\n QueryExternalFunctionTotalInvocations = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS\", JsonString),\n QueryExternalFunctionTotalSentRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS\", JsonString),\n QueryExternalFunctionTotalReceivedRows = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS\", JsonString),\n QueryExternalFunctionTotalSentBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES\", JsonString),\n QueryExternalFunctionTotalReceivedBytes = extractjson(\"$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES\", JsonString),\n QueryIsClientGeneratedStatement = extractjson(\"$.IS_CLIENT_GENERATED_STATEMENT\", JsonString),\n QueryAccelerationBytesScanned = extractjson(\"$.ACCELERATION_BYTES_SCANNED\", JsonString),\n QueryAccelerationPartitionsScanned = extractjson(\"$.ACCELERATION_PARTITIONS_SCANNED\", JsonString),\n QueryAccelerationUpperLimitScaleFactor = extractjson(\"$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR\", JsonString),\n QueryTransactionId = extractjson(\"$.TRANSACTION_ID\", JsonString),\n QueryLoadPercent = extractjson(\"$.QUERY_LOAD_PERCENT\", JsonString),\n ChildQueriesWaitTime = extractjson(\"$.CHILD_QUERIES_WAIT_TIME\", JsonString),\n QueryRoleType = extractjson(\"$.ROLE_TYPE\", JsonString),\n QueryHash = extractjson(\"$.HASH\", JsonString),\n QueryHashVersion = extractjson(\"$.HASH_VERSION\", JsonString),\n QueryParameterizedHash = extractjson(\"$.PARAMETERIZED_HASH\", JsonString),\n QueryParameterizedHashVersion = extractjson(\"$.PARAMETERIZED_HASH_VERSION\", JsonString),\n QuerySecondaryRoleStats = extractjson(\"$.SECONDARY_ROLE_STATS\", JsonString),\n QueryRowsWrittenToResult = extractjson(\"$.ROWS_WRITTEN_TO_RESULT\", JsonString),\n QueryRetryTime = extractjson(\"$.RETRY_TIME\", JsonString),\n QueryRetryCause = extractjson(\"$.RETRY_CAUSE\", JsonString),\n QueryFaultHandlingTime = extractjson(\"$.FAULT_HANDLING_TIME\", JsonString),\n QueryUserType = extractjson(\"$.USER_TYPE\", JsonString),\n QueryUserDatabaseName = extractjson(\"$.USER_DATABASE_NAME\", JsonString),\n QueryUserDatabaseId = extractjson(\"$.USER_DATABASE_ID\", JsonString),\n QueryUserSchemaId = extractjson(\"$.USER_SCHEMA_ID\", JsonString),\n QueryUserSchemaName = extractjson(\"$.USER_SCHEMA_NAME\", JsonString)\n};\nlet SnowflakeLoginV2_view = view () {\n SnowflakeLoginV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[1])\n | extend\n LoginEventId = tostring(DataList[0]),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(DataList[2]),\n LoginUserName = tostring(DataList[3]),\n LoginClientIp = tostring(DataList[4]),\n LoginReportedClientType = tostring(DataList[5]),\n LoginReportedClientVersion = tostring(DataList[6]),\n LoginFirstAuthenticationFactor = tostring(DataList[7]),\n LoginSecondAuthenticationFactor = tostring(DataList[8]),\n LoginIsSuccess = tostring(DataList[9]),\n LoginErrorCode = tostring(DataList[10]),\n LoginErrorMessage = tostring(DataList[11]),\n LoginRelatedEventId = tostring(DataList[12]),\n LoginConnection = tostring(DataList[13]),\n LoginClientPrivateLinkId = tostring(DataList[14]),\n LoginFirstAuthenticationFactorId = tostring(DataList[15]),\n LoginSecondAuthenticationFactorId = tostring(DataList[16]),\n LoginDetails = tostring(DataList[17]),\n LoginAuthorizingIntegrationName = tostring(DataList[18])\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV2_view = view () {\n SnowflakeUserGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n DTime = toreal(DataList[1])\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(DataList[2]),\n UserGrantGrantedTo = tostring(DataList[3]),\n UserGrantGranteeName = tostring(DataList[4]),\n UserGrantGrantedBy = tostring(DataList[5])\n};\nlet SnowflakeMaterializedViewV2_view = view () {\n SnowflakeMaterializedViewV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n STime = toreal(DataList[0]),\n ETime = toreal(DataList[1])\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(DataList[2]),\n MaterializedViewTableId = tostring(DataList[3]),\n MaterializedViewTableName = tostring(DataList[4]),\n MaterializedViewSchemaId = tostring(DataList[5]),\n MaterializedViewSchemaName = tostring(DataList[6]),\n MaterializedViewDatabaseId = tostring(DataList[7]),\n MaterializedViewDatabaseName = tostring(DataList[8])\n};\nlet SnowflakeRolesV2_view = view () {\n SnowflakeRolesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[1]),\n DTime = toreal(DataList[2])\n | extend\n RoleId = tostring(DataList[0]),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(DataList[3]),\n RoleComment = tostring(DataList[4]),\n RoleOwner = tostring(DataList[5]),\n RoleType = tostring(DataList[6]),\n RoleDatabaseName = tostring(DataList[7]),\n RoleInstanceId = tostring(DataList[8]),\n OwnerRoleType = tostring(DataList[9]),\n RoleIsFromOrganizationUserGroup = tostring(DataList[10])\n};\nlet SnowflakeRoleGrantV2_view = view () {\n SnowflakeRoleGrantV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[0]),\n MTime = toreal(DataList[1]),\n DTime = toreal(DataList[11])\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(DataList[2]),\n RoleGrantGrantedOn = tostring(DataList[3]),\n RoleGrantName = tostring(DataList[4]),\n RoleGrantTableCatalog = tostring(DataList[5]),\n RoleGrantTableSchema = tostring(DataList[6]),\n RoleGrantGrantedTo = tostring(DataList[7]),\n RoleGrantGranteeName = tostring(DataList[8]),\n RoleGrantGrantOption = tostring(DataList[9]),\n RoleGrantGrantedBy = tostring(DataList[10]),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(DataList[12]),\n RoleGrantObjectInstance = tostring(DataList[13])\n};\nlet SnowflakeLoadV2_view = view () {\n SnowflakeLoadV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n LTime = toreal(DataList[7])\n | extend\n LoadTableId = tostring(DataList[0]),\n LoadTableName = tostring(DataList[1]),\n LoadSchemaId = tostring(DataList[2]),\n LoadSchemaName = tostring(DataList[3]),\n LoadCatalogId = tostring(DataList[4]),\n LoadCatalogName = tostring(DataList[5]),\n LoadFileName = tostring(DataList[6]),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(DataList[8]),\n LoadRowCount = tostring(DataList[9]),\n LoadRowParsed = tostring(DataList[10]),\n LoadFirstErrorMessage = tostring(DataList[11]),\n LoadFirstErrorLineNumber = tostring(DataList[12]),\n LoadFirstErrorCharacterPosition = tostring(DataList[13]),\n LoadFirstErrorColName = tostring(DataList[14]),\n LoadErrorCount = tostring(DataList[15]),\n LoadErrorLimit = tostring(DataList[16])\n};\nlet SnowflakeTableStorageMetricsV2_view = view () {\n SnowflakeTableStorageMetricsV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[13]),\n TDTime = toreal(DataList[14]),\n TFTime = toreal(DataList[15]),\n SCTime = toreal(DataList[16]),\n SDTime = toreal(DataList[17]),\n CCTime = toreal(DataList[18]),\n CDTime = toreal(DataList[19])\n | extend\n TableStorageMetricsId = tostring(DataList[0]),\n TableStorageMetricsTableName = tostring(DataList[1]),\n TableStorageMetricsTableSchemaId = tostring(DataList[2]),\n TableStorageMetricsTableSchema = tostring(DataList[3]),\n TableStorageMetricsTableCatalogId = tostring(DataList[4]),\n TableStorageMetricsTableCatalog = tostring(DataList[5]),\n TableStorageMetricsCloneGroupId = tostring(DataList[6]),\n TableStorageMetricsIsTransient = tostring(DataList[7]),\n TableStorageMetricsActiveBytes = tostring(DataList[8]),\n TableStorageMetricsTimeTravelBytes = tostring(DataList[9]),\n TableStorageMetricsFailsafeBytes = tostring(DataList[10]),\n TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]),\n TableStorageMetricsDeleted = tostring(DataList[12]),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(DataList[20]),\n TableStorageMetricsInstanceId = tostring(DataList[21]),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29])\n};\nlet SnowflakeTablesV2_view = view () {\n SnowflakeTablesV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n TCTime = toreal(DataList[24]),\n LATime = toreal(DataList[25]),\n LDTime = toreal(DataList[26]),\n TDTime = toreal(DataList[28])\n | extend\n TableId = tostring(DataList[0]),\n TableName = tostring(DataList[1]),\n TableSchemaId = tostring(DataList[2]),\n TableSchema = tostring(DataList[3]),\n TableCatalogId = tostring(DataList[4]),\n TableCatalog = tostring(DataList[5]),\n TableOwner = tostring(DataList[6]),\n TableType = tostring(DataList[7]),\n TableIsTransient = tostring(DataList[8]),\n TableIsIceberg = tostring(DataList[9]),\n TableIsDynamic = tostring(DataList[10]),\n TableIsHybrid = tostring(DataList[11]),\n TableClusteringKey = tostring(DataList[12]),\n TableRowCount = tostring(DataList[13]),\n TableBytes = tostring(DataList[14]),\n TableRetentionTime = tostring(DataList[15]),\n TableSelfReferencingColumnName = tostring(DataList[16]),\n TableReferenceGeneration = tostring(DataList[17]),\n TableUserDefinedTypeCatalog = tostring(DataList[18]),\n TableUserDefinedTypeSchema = tostring(DataList[19]),\n TableUserDefinedTypeName = tostring(DataList[20]),\n TableIsInsertableInto = tostring(DataList[21]),\n TableIsTyped = tostring(DataList[22]),\n TableCommitAction = tostring(DataList[23]),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(DataList[27]),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(DataList[29]),\n TableComment = tostring(DataList[30]),\n TableOwnerRoleType = tostring(DataList[31]),\n TableInstanceId = tostring(DataList[32]),\n TableArchiveStorageCoolRowCount = tostring(DataList[33]),\n TableArchiveStorageCoolBytes = tostring(DataList[34]),\n TableArchiveStorageColdRowCount = tostring(DataList[35]),\n TableArchiveStorageColdBytes = tostring(DataList[36]),\n TableErrorLogging = tostring(DataList[37])\n};\nlet SnowflakeUsersV2_view = view () {\n SnowflakeUsersV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n CTime = toreal(DataList[2]),\n DTime = toreal(DataList[3]),\n BMTime = toreal(DataList[20]),\n LSLTime = toreal(DataList[21]),\n ETime = toreal(DataList[22]),\n LUTime = toreal(DataList[23]),\n PLSTime = toreal(DataList[25])\n | extend\n UserId = tostring(DataList[0]),\n UserName = tostring(DataList[1]),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(DataList[4]),\n UserDisplayName = tostring(DataList[5]),\n UserFirstName = tostring(DataList[6]),\n UserLastName = tostring(DataList[7]),\n UserEmail = tostring(DataList[8]),\n UserMustChangePassword = tostring(DataList[9]),\n UserHasPassword = tostring(DataList[10]),\n UserComment = tostring(DataList[11]),\n UserDisabled = tostring(DataList[12]),\n UserSnowflakeLock = tostring(DataList[13]),\n UserDefaultWarehouse = tostring(DataList[14]),\n UserDefaultNamespace = tostring(DataList[15]),\n UserDefaultRole = tostring(DataList[16]),\n UserExtAuthnDuo = tostring(DataList[17]),\n UserExtAuthnUid = tostring(DataList[18]),\n UserHasMFA = tostring(DataList[19]),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(DataList[24]),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(DataList[26]),\n UserDefaultSecondaryRole = tostring(DataList[27]),\n UserHasPAT = tostring(DataList[28]),\n UserHasWorkloadIdentity = tostring(DataList[29]),\n UserType = tostring(DataList[30]),\n UserDatabaseName = tostring(DataList[31]),\n UserDatabaseId = tostring(DataList[32]),\n UserSchemaName = tostring(DataList[33]),\n UserSchemaId = tostring(DataList[34]),\n UserIsFromOrganizationUser = tostring(DataList[35]),\n UserProvisionedBy = tostring(DataList[36]),\n UserIsEmailVerified = tostring(DataList[37])\n};\nlet SnowflakeQueryV2_view = view () {\n SnowflakeQueryV2_CL\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | mv-expand DataList = todynamic(Data)\n | extend\n QSTime = toreal(DataList[20]),\n QETime = toreal(DataList[21]),\n QueryTotalElapsedTime = toreal(DataList[22]),\n QueryExecutionTime = toreal(DataList[40])\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(DataList[0]),\n QueryText = tostring(DataList[1]),\n QueryDatabaseId = tostring(DataList[2]),\n QueryDatabaseName = tostring(DataList[3]),\n QuerySchemaId = tostring(DataList[4]),\n QuerySchemaName = tostring(DataList[5]),\n QueryType = tostring(DataList[6]),\n QuerySessionId = tostring(DataList[7]),\n QueryAuthnEventId = tostring(DataList[8]),\n QueryUserName = tostring(DataList[9]),\n QueryRoleName = tostring(DataList[10]),\n QueryWarehouseId = tostring(DataList[11]),\n QueryWarehouseName = tostring(DataList[12]),\n QueryWarehouseSize = tostring(DataList[13]),\n QueryWarehouseType = tostring(DataList[14]),\n QueryClusterNumber = tostring(DataList[15]),\n QueryTag = tostring(DataList[16]),\n QueryExecutionStatus = tostring(DataList[17]),\n QueryErrorCode = tostring(DataList[18]),\n QueryErrorMessage = tostring(DataList[19]),\n QueryBytesScanned = tostring(DataList[23]),\n QueryPercentageScannedFromCache = tostring(DataList[24]),\n QueryBytesWritten = tostring(DataList[25]),\n QueryBytesWrittenToResult = tostring(DataList[26]),\n QueryBytesReadFromResult = tostring(DataList[27]),\n QueryRowsProduced = tostring(DataList[28]),\n QueryRowsInserted = tostring(DataList[29]),\n QueryRowsUpdated = tostring(DataList[30]),\n QueryRowsDeleted = tostring(DataList[31]),\n QueryRowsUnloaded = tostring(DataList[32]),\n QueryBytesDeleted = tostring(DataList[33]),\n QueryPartitionsScanned = tostring(DataList[34]),\n QueryPartitionsTotal = tostring(DataList[35]),\n QueryBytesSpilledToLocalStorage = tostring(DataList[36]),\n QueryBytesSpilledToRemoteStorage = tostring(DataList[37]),\n QueryBytesSentOverTheNetwork = tostring(DataList[38]),\n QueryCompilationTime = tostring(DataList[39]),\n QueryQueuedProvisioningTime = tostring(DataList[41]),\n QueryQueuedRepairTime = tostring(DataList[42]),\n QueryQueuedOverloadTime = tostring(DataList[43]),\n QueryTransactionBlockedTime = tostring(DataList[44]),\n QueryOutboundDataTransferCloud = tostring(DataList[45]),\n QueryOutboundDataTransferRegion = tostring(DataList[46]),\n QueryOutboundDataTransferBytes = tostring(DataList[47]),\n QueryInboundDataTransferCloud = tostring(DataList[48]),\n QueryInboundDataTransferRegion = tostring(DataList[49]),\n QueryInboundDataTransferBytes = tostring(DataList[50]),\n QueryListExternalFilesTime = tostring(DataList[51]),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])),\n QueryReleaseVersion = tostring(DataList[53]),\n QueryExternalFunctionTotalInvocations = tostring(DataList[54]),\n QueryExternalFunctionTotalSentRows = tostring(DataList[55]),\n QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]),\n QueryExternalFunctionTotalSentBytes = tostring(DataList[57]),\n QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]),\n QueryLoadPercent = tostring(DataList[59]),\n QueryIsClientGeneratedStatement = tostring(DataList[60]),\n QueryAccelerationBytesScanned = tostring(DataList[61]),\n QueryAccelerationPartitionsScanned = tostring(DataList[62]),\n QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]),\n QueryTransactionId = tostring(DataList[64]),\n ChildQueriesWaitTime = tostring(DataList[65]),\n QueryRoleType = tostring(DataList[66]),\n QueryHash = tostring(DataList[67]),\n QueryHashVersion = tostring(DataList[68]),\n QueryParameterizedHash = tostring(DataList[69]),\n QueryParameterizedHashVersion = tostring(DataList[70]),\n QuerySecondaryRoleStats = tostring(DataList[71]),\n QueryRowsWrittenToResult = tostring(DataList[72]),\n QueryRetryTime = tostring(DataList[73]),\n QueryRetryCause = tostring(DataList[74]),\n QueryFaultHandlingTime = tostring(DataList[75]),\n QueryUserType = tostring(DataList[76]),\n QueryUserDatabaseName = tostring(DataList[77]),\n QueryUserDatabaseId = tostring(DataList[78]),\n QueryUserSchemaName = tostring(DataList[79]),\n QueryUserSchemaId = tostring(DataList[80]),\n QueryResourceConstraint = tostring(DataList[81]),\n QueryGeneration = tostring(DataList[82]),\n QueryBindValues = tostring(DataList[83]),\n QueryAgentType = tostring(DataList[84])\n};\nlet SnowflakeLoginV3_view = view () {\n union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(EventTimestamp)\n | extend\n LoginEventId = tostring(EventId),\n LoginEventTimestamp = unixtime_seconds_todatetime(LTime),\n LoginEventType = tostring(EventType),\n LoginUserName = tostring(UserName),\n LoginClientIp = tostring(ClientIp),\n LoginReportedClientType = tostring(ReportedClientType),\n LoginReportedClientVersion = tostring(ReportedClientVersion),\n LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor),\n LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor),\n LoginIsSuccess = tostring(IsSuccess),\n LoginErrorCode = tostring(ErrorCode),\n LoginErrorMessage = tostring(ErrorMessage),\n LoginRelatedEventId = tostring(RelatedEventId),\n LoginConnection = tostring(Connection),\n LoginClientPrivateLinkId = tostring(ClientPrivateLinkId),\n LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId),\n LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId),\n LoginDetails = tostring(LoginDetails),\n LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName)\n | extend\n TargetUsername = LoginUserName,\n SrcDvcIpAddr = LoginClientIp,\n User = LoginUserName,\n LoginEventEndTime = LoginEventTimestamp\n};\nlet SnowflakeUserGrantV3_view = view () {\n union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n UserGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n UserGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n UserRole = tostring(Role),\n UserGrantGrantedTo = tostring(GrantedTo),\n UserGrantGranteeName = tostring(GranteeName),\n UserGrantGrantedBy = tostring(GrantedBy)\n};\nlet SnowflakeMaterializedViewV3_view = view () {\n union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n STime = toreal(StartTime),\n ETime = toreal(EndTime)\n | extend\n MaterializedViewStartTime = unixtime_seconds_todatetime(STime),\n MaterializedViewEndTime = unixtime_seconds_todatetime(ETime),\n MaterializedViewCreditsUsed = tostring(CreditsUsed),\n MaterializedViewTableId = tostring(TableId),\n MaterializedViewTableName = tostring(TableName),\n MaterializedViewSchemaId = tostring(SchemaId),\n MaterializedViewSchemaName = tostring(SchemaName),\n MaterializedViewDatabaseId = tostring(DatabaseId),\n MaterializedViewDatabaseName = tostring(DatabaseName)\n};\nlet SnowflakeRolesV3_view = view () {\n union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleId = tostring(RoleId),\n RoleCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleName = tostring(Name),\n RoleComment = tostring(Comment),\n RoleOwner = tostring(Owner),\n RoleType = tostring(RoleType),\n RoleDatabaseName = tostring(RoleDatabaseName),\n RoleInstanceId = tostring(RoleInstanceId),\n OwnerRoleType = tostring(OwnerRoleType),\n RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup)\n};\nlet SnowflakeRoleGrantV3_view = view () {\n union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n MTime = toreal(ModifiedOn),\n DTime = toreal(DeletedOn)\n | extend\n RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime),\n RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime),\n RoleGrantPrivilege = tostring(Privilege),\n RoleGrantGrantedOn = tostring(GrantedOn),\n RoleGrantName = tostring(Name),\n RoleGrantTableCatalog = tostring(TableCatalog),\n RoleGrantTableSchema = tostring(TableSchema),\n RoleGrantGrantedTo = tostring(GrantedTo),\n RoleGrantGranteeName = tostring(GranteeName),\n RoleGrantGrantOption = tostring(GrantOption),\n RoleGrantGrantedBy = tostring(GrantedBy),\n RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime),\n RoleGrantGrantedByRoleType = tostring(GrantedByRoleType),\n RoleGrantObjectInstance = tostring(ObjectInstance)\n};\nlet SnowflakeLoadV3_view = view () {\n union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n LTime = toreal(LastLoadTime)\n | extend\n LoadTableId = tostring(TableId),\n LoadTableName = tostring(TableName),\n LoadSchemaId = tostring(SchemaId),\n LoadSchemaName = tostring(SchemaName),\n LoadCatalogId = tostring(CatalogId),\n LoadCatalogName = tostring(CatalogName),\n LoadFileName = tostring(FileName),\n LoadLastLoadTime = unixtime_seconds_todatetime(LTime),\n LoadStatus = tostring(Status),\n LoadRowCount = tostring(RowCount),\n LoadRowParsed = tostring(RowParsed),\n LoadFirstErrorMessage = tostring(FirstErrorMessage),\n LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber),\n LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition),\n LoadFirstErrorColName = tostring(FirstErrorColName),\n LoadErrorCount = tostring(ErrorCount),\n LoadErrorLimit = tostring(ErrorLimit)\n};\nlet SnowflakeTableStorageMetricsV3_view = view () {\n union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(TableCreated),\n TDTime = toreal(TableDropped),\n TFTime = toreal(TableEnteredFailsafe),\n SCTime = toreal(SchemaCreated),\n SDTime = toreal(SchemaDropped),\n CCTime = toreal(CatalogCreated),\n CDTime = toreal(CatalogDropped)\n | extend\n TableStorageMetricsId = tostring(Id),\n TableStorageMetricsTableName = tostring(TableName),\n TableStorageMetricsTableSchemaId = tostring(TableSchemaId),\n TableStorageMetricsTableSchema = tostring(TableSchema),\n TableStorageMetricsTableCatalogId = tostring(TableCatalogId),\n TableStorageMetricsTableCatalog = tostring(TableCatalog),\n TableStorageMetricsCloneGroupId = tostring(CloneGroupId),\n TableStorageMetricsIsTransient = tostring(IsTransient),\n TableStorageMetricsActiveBytes = tostring(ActiveBytes),\n TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes),\n TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes),\n TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes),\n TableStorageMetricsDeleted = tostring(Deleted),\n TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime),\n TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime),\n TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime),\n TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime),\n TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime),\n TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime),\n TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime),\n TableStorageMetricsComment = tostring(Comment),\n TableStorageMetricsInstanceId = tostring(InstanceId),\n TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes),\n TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes)\n | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped\n};\nlet SnowflakeTablesV3_view = view () {\n union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n TCTime = toreal(Created),\n LATime = toreal(LastAltered),\n LDTime = toreal(LastDdl),\n TDTime = toreal(Deleted)\n | extend\n TableId = tostring(TableId),\n TableName = tostring(TableName),\n TableSchemaId = tostring(TableSchemaId),\n TableSchema = tostring(TableSchema),\n TableCatalogId = tostring(TableCatalogId),\n TableCatalog = tostring(TableCatalog),\n TableOwner = tostring(TableOwner),\n TableType = tostring(TableType),\n TableIsTransient = tostring(IsTransient),\n TableIsIceberg = tostring(IsIceberg),\n TableIsDynamic = tostring(IsDynamic),\n TableIsHybrid = tostring(IsHybrid),\n TableClusteringKey = tostring(ClusteringKey),\n TableRowCount = tostring(RowCount),\n TableBytes = tostring(Bytes),\n TableRetentionTime = tostring(RetentionTime),\n TableSelfReferencingColumnName = tostring(SelfReferencingColumnName),\n TableReferenceGeneration = tostring(ReferenceGeneration),\n TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog),\n TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema),\n TableUserDefinedTypeName = tostring(UserDefinedTypeName),\n TableIsInsertableInto = tostring(IsInsertableInto),\n TableIsTyped = tostring(IsTyped),\n TableCommitAction = tostring(CommitAction),\n TableCreated = unixtime_seconds_todatetime(TCTime),\n TableLastAltered = unixtime_seconds_todatetime(LATime),\n TableLastDDL = unixtime_seconds_todatetime(LDTime),\n TableLastDDLBy = tostring(LastDdlBy),\n TableDeleted = unixtime_seconds_todatetime(TDTime),\n TableAutoClusteringOn = tostring(AutoClusteringOn),\n TableComment = tostring(Comment),\n TableOwnerRoleType = tostring(OwnerRoleType),\n TableInstanceId = tostring(InstanceId),\n TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount),\n TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes),\n TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount),\n TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes),\n TableErrorLogging = tostring(ErrorLogging)\n};\nlet SnowflakeUsersV3_view = view () {\n union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n CTime = toreal(CreatedOn),\n DTime = toreal(DeletedOn),\n BMTime = toreal(BypassMfaUntil),\n LSLTime = toreal(LastSuccessLogin),\n ETime = toreal(ExpiresAt),\n LUTime = toreal(LockedUntilTime),\n PLSTime = toreal(PasswordLastSetTime)\n | extend\n UserId = tostring(UserId),\n UserName = tostring(Name),\n UserCreatedOn = unixtime_seconds_todatetime(CTime),\n UserDeletedOn = unixtime_seconds_todatetime(DTime),\n UserLoginName = tostring(LoginName),\n UserDisplayName = tostring(DisplayName),\n UserFirstName = tostring(FirstName),\n UserLastName = tostring(LastName),\n UserEmail = tostring(Email),\n UserMustChangePassword = tostring(MustChangePassword),\n UserHasPassword = tostring(HasPassword),\n UserComment = tostring(Comment),\n UserDisabled = tostring(Disabled),\n UserSnowflakeLock = tostring(SnowflakeLock),\n UserDefaultWarehouse = tostring(DefaultWarehouse),\n UserDefaultNamespace = tostring(DefaultNamespace),\n UserDefaultRole = tostring(DefaultRole),\n UserExtAuthnDuo = tostring(ExtAuthnDuo),\n UserExtAuthnUid = tostring(ExtAuthnUid),\n UserHasMFA = tostring(HasMfa),\n UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime),\n UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime),\n UserExpiresAt = unixtime_seconds_todatetime(ETime),\n UserLockedUntilTime = unixtime_seconds_todatetime(LUTime),\n UserHasRSAPublicKey = tostring(HasRsaPublicKey),\n UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime),\n UserOwner = tostring(Owner),\n UserDefaultSecondaryRole = tostring(DefaultSecondaryRole),\n UserHasPAT = tostring(HasPat),\n UserHasWorkloadIdentity = tostring(HasWorkloadIdentity),\n UserType = tostring(UserType),\n UserDatabaseName = tostring(DatabaseName),\n UserDatabaseId = tostring(DatabaseId),\n UserSchemaName = tostring(SchemaName),\n UserSchemaId = tostring(SchemaId),\n UserIsFromOrganizationUser = tostring(IsFromOrganizationUser),\n UserProvisionedBy = tostring(ProvisionedBy),\n UserIsEmailVerified = tostring(IsEmailVerified)\n};\nlet SnowflakeQueryV3_view = view () {\n union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[])\n | extend EventVendor = 'Snowflake'\n | extend EventProduct = 'Snowflake'\n | extend\n QSTime = toreal(StartTime),\n QETime = toreal(EndTime),\n QueryTotalElapsedTime = toreal(TotalElapsedTime),\n QueryExecutionTime = toreal(ExecutionTime)\n | extend\n QueryStartTime = unixtime_seconds_todatetime(QSTime),\n QueryEndTime = unixtime_seconds_todatetime(QETime)\n | extend\n QueryId = tostring(QueryId),\n QueryText = tostring(QueryText),\n QueryDatabaseId = tostring(DatabaseId),\n QueryDatabaseName = tostring(DatabaseName),\n QuerySchemaId = tostring(SchemaId),\n QuerySchemaName = tostring(SchemaName),\n QueryType = tostring(QueryType),\n QuerySessionId = tostring(SessionId),\n QueryAuthnEventId = tostring(AuthnEventId),\n QueryUserName = tostring(UserName),\n QueryRoleName = tostring(RoleName),\n QueryWarehouseId = tostring(WarehouseId),\n QueryWarehouseName = tostring(WarehouseName),\n QueryWarehouseSize = tostring(WarehouseSize),\n QueryWarehouseType = tostring(WarehouseType),\n QueryClusterNumber = tostring(ClusterNumber),\n QueryTag = tostring(QueryTag),\n QueryExecutionStatus = tostring(ExecutionStatus),\n QueryErrorCode = tostring(ErrorCode),\n QueryErrorMessage = tostring(ErrorMessage),\n QueryBytesScanned = tostring(BytesScanned),\n QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache),\n QueryBytesWritten = tostring(BytesWritten),\n QueryBytesWrittenToResult = tostring(BytesWrittenToResult),\n QueryBytesReadFromResult = tostring(BytesReadFromResult),\n QueryRowsProduced = tostring(RowsProduced),\n QueryRowsInserted = tostring(RowsInserted),\n QueryRowsUpdated = tostring(RowsUpdated),\n QueryRowsDeleted = tostring(RowsDeleted),\n QueryRowsUnloaded = tostring(RowsUnloaded),\n QueryBytesDeleted = tostring(BytesDeleted),\n QueryPartitionsScanned = tostring(PartitionsScanned),\n QueryPartitionsTotal = tostring(PartitionsTotal),\n QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage),\n QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage),\n QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork),\n QueryCompilationTime = tostring(CompilationTime),\n QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime),\n QueryQueuedRepairTime = tostring(QueuedRepairTime),\n QueryQueuedOverloadTime = tostring(QueuedOverloadTime),\n QueryTransactionBlockedTime = tostring(TransactionBlockedTime),\n QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud),\n QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion),\n QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes),\n QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud),\n QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion),\n QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes),\n QueryListExternalFilesTime = tostring(ListExternalFilesTime),\n QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)),\n QueryReleaseVersion = tostring(ReleaseVersion),\n QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations),\n QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows),\n QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows),\n QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes),\n QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes),\n QueryLoadPercent = tostring(QueryLoadPercent),\n QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement),\n QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned),\n QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned),\n QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor),\n QueryTransactionId = tostring(TransactionId),\n ChildQueriesWaitTime = tostring(ChildQueriesWaitTime),\n QueryRoleType = tostring(RoleType),\n QueryHash = tostring(QueryHash),\n QueryHashVersion = tostring(QueryHashVersion),\n QueryParameterizedHash = tostring(QueryParameterizedHash),\n QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion),\n QuerySecondaryRoleStats = tostring(SecondaryRoleStats),\n QueryRowsWrittenToResult = tostring(RowsWrittenToResult),\n QueryRetryTime = tostring(QueryRetryTime),\n QueryRetryCause = tostring(QueryRetryCause),\n QueryFaultHandlingTime = tostring(FaultHandlingTime),\n QueryUserType = tostring(UserType),\n QueryUserDatabaseName = tostring(UserDatabaseName),\n QueryUserDatabaseId = tostring(UserDatabaseId),\n QueryUserSchemaName = tostring(UserSchemaName),\n QueryUserSchemaId = tostring(UserSchemaId),\n QueryResourceConstraint = tostring(ResourceConstraint),\n QueryGeneration = tostring(Generation),\n QueryBindValues = tostring(BindValues),\n QueryAgentType = tostring(AgentType)\n};\nunion isfuzzy=true\n (Snowflake_view),\n (SnowflakeLogin_view),\n (SnowflakeLoginV3_view),\n (SnowflakeLoginV2_view),\n (SnowflakeUserGrant_view),\n (SnowflakeUserGrantV3_view),\n (SnowflakeUserGrantV2_view),\n (SnowflakeMaterializedView_view),\n (SnowflakeMaterializedViewV3_view),\n (SnowflakeMaterializedViewV2_view),\n (SnowflakeRoles_view),\n (SnowflakeRolesV3_view),\n (SnowflakeRolesV2_view),\n (SnowflakeRoleGrant_view),\n (SnowflakeRoleGrantV3_view),\n (SnowflakeRoleGrantV2_view),\n (SnowflakeLoad_view),\n (SnowflakeLoadV3_view),\n (SnowflakeLoadV2_view),\n (SnowflakeTableStorageMetrics_view),\n (SnowflakeTableStorageMetricsV3_view),\n (SnowflakeTableStorageMetricsV2_view),\n (SnowflakeTables_view),\n (SnowflakeTablesV3_view),\n (SnowflakeTablesV2_view),\n (SnowflakeUsers_view),\n (SnowflakeUsersV3_view),\n (SnowflakeUsersV2_view),\n (SnowflakeQuery_view),\n (SnowflakeQueryV3_view),\n (SnowflakeQueryV2_view)\n| extend\n LoginEventType = column_ifexists('LoginEventType', ''),\n TargetUsername = column_ifexists('TargetUsername', ''),\n SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''),\n User = column_ifexists('User', ''),\n LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')),\n LoginEventId = column_ifexists('LoginEventId', ''),\n LoginReportedClientType = column_ifexists('LoginReportedClientType', ''),\n LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''),\n LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''),\n LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''),\n LoginIsSuccess = column_ifexists('LoginIsSuccess', ''),\n LoginErrorCode = column_ifexists('LoginErrorCode', ''),\n LoginErrorMessage = column_ifexists('LoginErrorMessage', ''),\n LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''),\n LoginConnection = column_ifexists('LoginConnection', ''),\n LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''),\n LoginUserName = column_ifexists('LoginUserName', ''),\n LoginClientIp = column_ifexists('LoginClientIp', ''),\n LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')),\n LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''),\n LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''),\n LoginDetails = column_ifexists('LoginDetails', ''),\n LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''),\n UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')),\n UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')),\n UserRole = column_ifexists('UserRole', ''),\n UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''),\n UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''),\n UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''),\n MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')),\n MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')),\n MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''),\n MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''),\n MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''),\n MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''),\n MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''),\n MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''),\n MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''),\n RoleId = column_ifexists('RoleId', ''),\n RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')),\n RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')),\n RoleName = column_ifexists('RoleName', ''),\n RoleComment = column_ifexists('RoleComment', ''),\n RoleOwner = column_ifexists('RoleOwner', ''),\n RoleType = column_ifexists('RoleType', ''),\n RoleDatabaseName = column_ifexists('RoleDatabaseName', ''),\n RoleInstanceId = column_ifexists('RoleInstanceId', ''),\n OwnerRoleType = column_ifexists('OwnerRoleType', ''),\n RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''),\n RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')),\n RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')),\n RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''),\n RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''),\n RoleGrantName = column_ifexists('RoleGrantName', ''),\n RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''),\n RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''),\n RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''),\n RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''),\n RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''),\n RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''),\n RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')),\n RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''),\n RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''),\n LoadTableId = column_ifexists('LoadTableId', ''),\n LoadTableName = column_ifexists('LoadTableName', ''),\n LoadSchemaId = column_ifexists('LoadSchemaId', ''),\n LoadSchemaName = column_ifexists('LoadSchemaName', ''),\n LoadCatalogId = column_ifexists('LoadCatalogId', ''),\n LoadCatalogName = column_ifexists('LoadCatalogName', ''),\n LoadFileName = column_ifexists('LoadFileName', ''),\n LastLoadTime = column_ifexists('LastLoadTime', ''),\n LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')),\n LoadStatus = column_ifexists('LoadStatus', ''),\n LoadRowCount = column_ifexists('LoadRowCount', ''),\n LoadRowParsed = column_ifexists('LoadRowParsed', ''),\n LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''),\n LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''),\n LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''),\n LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''),\n LoadErrorCount = column_ifexists('LoadErrorCount', ''),\n LoadErrorLimit = column_ifexists('LoadErrorLimit', ''),\n TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''),\n TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''),\n TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''),\n TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''),\n TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''),\n TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''),\n TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''),\n TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''),\n TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''),\n TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''),\n TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''),\n TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''),\n TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''),\n TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')),\n TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')),\n TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')),\n TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')),\n TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')),\n TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')),\n TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')),\n TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''),\n TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''),\n TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''),\n TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''),\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''),\n TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''),\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''),\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''),\n TableId = column_ifexists('TableId', ''),\n TableName = column_ifexists('TableName', ''),\n TableSchemaId = column_ifexists('TableSchemaId', ''),\n TableSchema = column_ifexists('TableSchema', ''),\n TableCatalogId = column_ifexists('TableCatalogId', ''),\n TableCatalog = column_ifexists('TableCatalog', ''),\n TableOwner = column_ifexists('TableOwner', ''),\n TableType = column_ifexists('TableType', ''),\n TableIsTransient = column_ifexists('TableIsTransient', ''),\n TableIsIceberg = column_ifexists('TableIsIceberg', ''),\n TableIsDynamic = column_ifexists('TableIsDynamic', ''),\n TableIsHybrid = column_ifexists('TableIsHybrid', ''),\n TableClusteringKey = column_ifexists('TableClusteringKey', ''),\n TableRowCount = column_ifexists('TableRowCount', ''),\n TableBytes = column_ifexists('TableBytes', ''),\n TableRetentionTime = column_ifexists('TableRetentionTime', ''),\n TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''),\n TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''),\n TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''),\n TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''),\n TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''),\n TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''),\n TableIsTyped = column_ifexists('TableIsTyped', ''),\n TableCommitAction = column_ifexists('TableCommitAction', ''),\n TableCreated = todatetime(column_ifexists('TableCreated', '')),\n TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')),\n TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')),\n TableLastDDLBy = column_ifexists('TableLastDDLBy', ''),\n TableDeleted = todatetime(column_ifexists('TableDeleted', '')),\n TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''),\n TableComment = column_ifexists('TableComment', ''),\n TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''),\n TableInstanceId = column_ifexists('TableInstanceId', ''),\n TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''),\n TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''),\n TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''),\n TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''),\n TableErrorLogging = column_ifexists('TableErrorLogging', ''),\n UserId = column_ifexists('UserId', ''),\n UserName = column_ifexists('UserName', ''),\n UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')),\n UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')),\n UserLoginName = column_ifexists('UserLoginName', ''),\n UserDisplayName = column_ifexists('UserDisplayName', ''),\n UserFirstName = column_ifexists('UserFirstName', ''),\n UserLastName = column_ifexists('UserLastName', ''),\n UserEmail = column_ifexists('UserEmail', ''),\n UserMustChangePassword = column_ifexists('UserMustChangePassword', ''),\n UserHasPassword = column_ifexists('UserHasPassword', ''),\n UserComment = column_ifexists('UserComment', ''),\n UserDisabled = column_ifexists('UserDisabled', ''),\n UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''),\n UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''),\n UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''),\n UserDefaultRole = column_ifexists('UserDefaultRole', ''),\n UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''),\n UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''),\n UserHasMFA = column_ifexists('UserHasMFA', ''),\n UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')),\n UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')),\n UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')),\n UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')),\n UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''),\n UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')),\n UserOwner = column_ifexists('UserOwner', ''),\n UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''),\n UserHasPAT = column_ifexists('UserHasPAT', ''),\n UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''),\n UserType = column_ifexists('UserType', ''),\n UserDatabaseName = column_ifexists('UserDatabaseName', ''),\n UserDatabaseId = column_ifexists('UserDatabaseId', ''),\n UserSchemaName = column_ifexists('UserSchemaName', ''),\n UserSchemaId = column_ifexists('UserSchemaId', ''),\n UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''),\n UserProvisionedBy = column_ifexists('UserProvisionedBy', ''),\n UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''),\n QueryId = column_ifexists('QueryId', ''),\n QueryText = column_ifexists('QueryText', ''),\n QueryDatabaseId = column_ifexists('QueryDatabaseId', ''),\n QueryDatabaseName = column_ifexists('QueryDatabaseName', ''),\n QuerySchemaId = column_ifexists('QuerySchemaId', ''),\n QuerySchemaName = column_ifexists('QuerySchemaName', ''),\n QueryType = column_ifexists('QueryType', ''),\n QuerySessionId = column_ifexists('QuerySessionId', ''),\n QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''),\n QueryUserName = column_ifexists('QueryUserName', ''),\n QueryRoleName = column_ifexists('QueryRoleName', ''),\n QueryWarehouseId = column_ifexists('QueryWarehouseId', ''),\n QueryWarehouseName = column_ifexists('QueryWarehouseName', ''),\n QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''),\n QueryWarehouseType = column_ifexists('QueryWarehouseType', ''),\n QueryClusterNumber = column_ifexists('QueryClusterNumber', ''),\n QueryTag = column_ifexists('QueryTag', ''),\n QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''),\n QueryErrorCode = column_ifexists('QueryErrorCode', ''),\n QueryErrorMessage = column_ifexists('QueryErrorMessage', ''),\n QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')),\n QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''),\n QueryBytesScanned = column_ifexists('QueryBytesScanned', ''),\n QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''),\n QueryBytesWritten = column_ifexists('QueryBytesWritten', ''),\n QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''),\n QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''),\n QueryRowsProduced = column_ifexists('QueryRowsProduced', ''),\n QueryRowsInserted = column_ifexists('QueryRowsInserted', ''),\n QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''),\n QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''),\n QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''),\n QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''),\n QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''),\n QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''),\n QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''),\n QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''),\n QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''),\n QueryCompilationTime = column_ifexists('QueryCompilationTime', ''),\n QueryExecutionTime = column_ifexists('QueryExecutionTime', ''),\n QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''),\n QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''),\n QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''),\n QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''),\n QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''),\n QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''),\n QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''),\n QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''),\n QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''),\n QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''),\n QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''),\n QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''),\n QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''),\n QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''),\n QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''),\n QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''),\n QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''),\n QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''),\n QueryLoadPercent = column_ifexists('QueryLoadPercent', ''),\n QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''),\n QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''),\n QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''),\n QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''),\n QueryTransactionId = column_ifexists('QueryTransactionId', ''),\n ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''),\n QueryRoleType = column_ifexists('QueryRoleType', ''),\n QueryHash = column_ifexists('QueryHash', ''),\n QueryHashVersion = column_ifexists('QueryHashVersion', ''),\n QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''),\n QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''),\n QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''),\n QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''),\n QueryRetryTime = column_ifexists('QueryRetryTime', ''),\n QueryRetryCause = column_ifexists('QueryRetryCause', ''),\n QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''),\n QueryUserType = column_ifexists('QueryUserType', ''),\n QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''),\n QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''),\n QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''),\n QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''),\n QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''),\n QueryGeneration = column_ifexists('QueryGeneration', ''),\n QueryBindValues = column_ifexists('QueryBindValues', ''),\n QueryAgentType = column_ifexists('QueryAgentType', '')\n| extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName)\n| extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName)\n| extend EventStartTime = coalesce(\n todatetime(column_ifexists('EventStartTime', todatetime(''))),\n LoginEventTimestamp,\n QueryStartTime,\n MaterializedViewStartTime,\n RoleGrantCreatedOn,\n RoleCreatedOn,\n LoadLastLoadTime,\n TableCreated,\n UserCreatedOn,\n TimeGenerated)\n| extend Type = column_ifexists('Type', '')\n| project\n EventVendor,\n EventProduct,\n EventStartTime,\n LoginEventType,\n TargetUsername,\n SrcDvcIpAddr,\n User,\n LoginEventEndTime,\n LoginEventId,\n LoginReportedClientType,\n LoginReportedClientVersion,\n LoginFirstAuthenticationFactor,\n LoginSecondAuthenticationFactor,\n LoginIsSuccess,\n LoginErrorCode,\n LoginErrorMessage,\n LoginRelatedEventId,\n LoginConnection,\n LoginClientPrivateLinkId,\n LoginUserName,\n LoginClientIp,\n LoginEventTimestamp,\n LoginFirstAuthenticationFactorId,\n LoginSecondAuthenticationFactorId,\n LoginDetails,\n LoginAuthorizingIntegrationName,\n UserGrantCreatedOn,\n UserGrantDeletedOn,\n UserRole,\n UserGrantGrantedTo,\n UserGrantGranteeName,\n UserGrantGrantedBy,\n MaterializedViewStartTime,\n MaterializedViewEndTime,\n MaterializedViewCreditsUsed,\n MaterializedViewTableId,\n MaterializedViewTableName,\n MaterializedViewSchemaId,\n MaterializedViewSchemaName,\n MaterializedViewDatabaseId,\n MaterializedViewDatabaseName,\n RoleId,\n RoleCreatedOn,\n RoleDeletedOn,\n RoleName,\n RoleComment,\n RoleOwner,\n RoleType,\n RoleDatabaseName,\n RoleInstanceId,\n OwnerRoleType,\n RoleIsFromOrganizationUserGroup,\n RoleGrantCreatedOn,\n RoleGrantModifiedOn,\n RoleGrantPrivilege,\n RoleGrantGrantedOn,\n RoleGrantName,\n RoleGrantTableCatalog,\n RoleGrantTableSchema,\n RoleGrantGrantedTo,\n RoleGrantGranteeName,\n RoleGrantGrantOption,\n RoleGrantGrantedBy,\n RoleGrantDeletedOn,\n RoleGrantGrantedByRoleType,\n RoleGrantObjectInstance,\n LoadTableId,\n LoadTableName,\n LoadSchemaId,\n LoadSchemaName,\n LoadCatalogId,\n LoadCatalogName,\n LoadFileName,\n LastLoadTime,\n LoadLastLoadTime,\n LoadStatus,\n LoadRowCount,\n LoadRowParsed,\n LoadFirstErrorMessage,\n LoadFirstErrorLineNumber,\n LoadFirstErrorCharacterPosition,\n LoadFirstErrorColName,\n LoadErrorCount,\n LoadErrorLimit,\n TableStorageMetricsId,\n TableStorageMetricsTableName,\n TableStorageMetricsTableSchemaId,\n TableStorageMetricsTableSchema,\n TableStorageMetricsTableCatalogId,\n TableStorageMetricsTableCatalog,\n TableStorageMetricsCloneGroupId,\n TableStorageMetricsIsTransient,\n TableStorageMetricsActiveBytes,\n TableStorageMetricsTimeTravelBytes,\n TableStorageMetricsFailsafeBytes,\n TableStorageMetricsRetainedForCloneBytes,\n TableStorageMetricsDeleted,\n TableStorageMetricsTableCreated,\n TableStorageMetricsTableDropped,\n TableStorageMetricsTableEnteredFailsafe,\n TableStorageMetricsSchemaCreated,\n TableStorageMetricsSchemaDropped,\n TableStorageMetricsCatalogCreated,\n TableStorageMetricsCatalogDropped,\n TableStorageMetricsComment,\n TableStorageMetricsInstanceId,\n TableStorageMetricsArchiveStorageCoolActiveBytes,\n TableStorageMetricsArchiveStorageColdActiveBytes,\n TableStorageMetricsArchiveStorageCoolTimeTravelBytes,\n TableStorageMetricsArchiveStorageColdTimeTravelBytes,\n TableStorageMetricsArchiveStorageCoolFailsafeBytes,\n TableStorageMetricsArchiveStorageColdFailsafeBytes,\n TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes,\n TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes,\n TableId,\n TableName,\n TableNames,\n TableSchemaId,\n TableSchema,\n TableCatalogId,\n TableCatalog,\n TableOwner,\n TableType,\n TableIsTransient,\n TableIsIceberg,\n TableIsDynamic,\n TableIsHybrid,\n TableClusteringKey,\n TableRowCount,\n TableBytes,\n TableRetentionTime,\n TableSelfReferencingColumnName,\n TableReferenceGeneration,\n TableUserDefinedTypeCatalog,\n TableUserDefinedTypeSchema,\n TableUserDefinedTypeName,\n TableIsInsertableInto,\n TableIsTyped,\n TableCommitAction,\n TableCreated,\n TableLastAltered,\n TableLastDDL,\n TableLastDDLBy,\n TableDeleted,\n TableAutoClusteringOn,\n TableComment,\n TableOwnerRoleType,\n TableInstanceId,\n TableArchiveStorageCoolRowCount,\n TableArchiveStorageCoolBytes,\n TableArchiveStorageColdRowCount,\n TableArchiveStorageColdBytes,\n TableErrorLogging,\n UserId,\n UserName,\n UserCreatedOn,\n UserDeletedOn,\n UserLoginName,\n UserDisplayName,\n UserFirstName,\n UserLastName,\n UserEmail,\n UserMustChangePassword,\n UserHasPassword,\n UserComment,\n UserDisabled,\n UserSnowflakeLock,\n UserDefaultWarehouse,\n UserDefaultNamespace,\n UserDefaultRole,\n UserExtAuthnDuo,\n UserExtAuthnUid,\n UserHasMFA,\n UserBypassMFAUntil,\n UserLastSuccessLogin,\n UserExpiresAt,\n UserLockedUntilTime,\n UserHasRSAPublicKey,\n UserPasswordLastSetTime,\n UserOwner,\n UserDefaultSecondaryRole,\n UserHasPAT,\n UserHasWorkloadIdentity,\n UserType,\n UserDatabaseName,\n UserDatabaseId,\n UserSchemaName,\n UserSchemaId,\n UserIsFromOrganizationUser,\n UserProvisionedBy,\n UserIsEmailVerified,\n QueryId,\n QueryText,\n QueryDatabaseId,\n QueryDatabaseName,\n QuerySchemaId,\n QuerySchemaName,\n QueryType,\n QuerySessionId,\n QueryAuthnEventId,\n QueryUserName,\n QueryRoleName,\n QueryWarehouseId,\n QueryWarehouseName,\n QueryWarehouseSize,\n QueryWarehouseType,\n QueryClusterNumber,\n QueryTag,\n QueryExecutionStatus,\n QueryErrorCode,\n QueryErrorMessage,\n QueryStartTime,\n QueryTotalElapsedTime,\n QueryBytesScanned,\n QueryPercentageScannedFromCache,\n QueryBytesWritten,\n QueryBytesWrittenToResult,\n QueryBytesReadFromResult,\n QueryRowsProduced,\n QueryRowsInserted,\n QueryRowsUpdated,\n QueryRowsDeleted,\n QueryRowsUnloaded,\n QueryBytesDeleted,\n QueryPartitionsScanned,\n QueryPartitionsTotal,\n QueryBytesSpilledToLocalStorage,\n QueryBytesSpilledToRemoteStorage,\n QueryBytesSentOverTheNetwork,\n QueryCompilationTime,\n QueryExecutionTime,\n QueryQueuedProvisioningTime,\n QueryQueuedRepairTime,\n QueryQueuedOverloadTime,\n QueryTransactionBlockedTime,\n QueryOutboundDataTransferCloud,\n QueryOutboundDataTransferRegion,\n QueryOutboundDataTransferBytes,\n QueryInboundDataTransferCloud,\n QueryInboundDataTransferRegion,\n QueryInboundDataTransferBytes,\n QueryListExternalFilesTime,\n QueryCreditsUsedCloudServices,\n QueryReleaseVersion,\n QueryExternalFunctionTotalInvocations,\n QueryExternalFunctionTotalSentRows,\n QueryExternalFunctionTotalReceivedRows,\n QueryExternalFunctionTotalSentBytes,\n QueryExternalFunctionTotalReceivedBytes,\n QueryLoadPercent,\n QueryIsClientGeneratedStatement,\n QueryAccelerationBytesScanned,\n QueryAccelerationPartitionsScanned,\n QueryAccelerationUpperLimitScaleFactor,\n QueryTransactionId,\n ChildQueriesWaitTime,\n QueryRoleType,\n QueryHash,\n QueryHashVersion,\n QueryParameterizedHash,\n QueryParameterizedHashVersion,\n QuerySecondaryRoleStats,\n QueryRowsWrittenToResult,\n QueryRetryTime,\n QueryRetryCause,\n QueryFaultHandlingTime,\n QueryUserType,\n QueryUserDatabaseName,\n QueryUserDatabaseId,\n QueryUserSchemaName,\n QueryUserSchemaId,\n QueryResourceConstraint,\n QueryGeneration,\n QueryBindValues,\n QueryAgentType,\n DatabaseName,\n TimeGenerated,\n Type\n};\nlet adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']);\n__xdr_inline_Snowflake\n| where QueryType =~ 'GRANT'\n| where QueryText startswith 'GRANT ROLE'\n| extend granted_role = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser', 1, QueryText)\n| where granted_role in~ (adm_roles)\n| extend usr = extract(@'GRANT ROLE\\s(\\S+)\\sto\\suser(\\S+)', 2, QueryText)\n| extend AccountCustomEntity = usr" + }, + "id": "[if(true(), 'xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a', 'xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a')]", + "status": "disabled", + "detectionAction": { + "alertTemplate": { + "description": "'Detects when user asigned admin privileges.'", + "tactics": [ + { + "tactic": "PrivilegeEscalation", + "techniques": [ + { + "technique": "T1078" + } + ] + } + ], + "entityMappings": { + "accounts": [ + { + "id": "[if(true(), 'account1', 'account1')]", + "upnColumn": "AccountCustomEntity" + } + ] + }, + "title": "Snowflake - User granted admin privileges", + "severity": "medium" + } + }, + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "contentVersion": "3.2.1" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "contentKind": "CustomDetection", + "displayName": "Snowflake - User granted admin privileges", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a','-','3.2.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a','-','3.2.1')))]", + "version": "3.2.1", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-snowflake", + "packageVersion": "3.2.2", + "contentId": "xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a", + "contentVersion": "3.2.1", + "requiredWorkloads": [ + { + "dataTypes": [ + "Snowflake_CL", + "SnowflakeLoad_CL", + "SnowflakeLoadV2_CL", + "SnowflakeLoadV3_CL", + "SnowflakeLogin_CL", + "SnowflakeLoginV2_CL", + "SnowflakeLoginV3_CL", + "SnowflakeMaterializedView_CL", + "SnowflakeMaterializedViewV2_CL", + "SnowflakeMaterializedViewV3_CL", + "SnowflakeQuery_CL", + "SnowflakeQueryV2_CL", + "SnowflakeQueryV3_CL", + "SnowflakeRoleGrant_CL", + "SnowflakeRoleGrantV2_CL", + "SnowflakeRoleGrantV3_CL", + "SnowflakeRoles_CL", + "SnowflakeRolesV2_CL", + "SnowflakeRolesV3_CL", + "SnowflakeTableStorageMetrics_CL", + "SnowflakeTableStorageMetricsV2_CL", + "SnowflakeTableStorageMetricsV3_CL", + "SnowflakeTables_CL", + "SnowflakeTablesV2_CL", + "SnowflakeTablesV3_CL", + "SnowflakeUserGrant_CL", + "SnowflakeUserGrantV2_CL", + "SnowflakeUserGrantV3_CL", + "SnowflakeUsers_CL", + "SnowflakeUsersV2_CL", + "SnowflakeUsersV3_CL" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "Snowflake" + ], + "connectorId": "Snowflake" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-951bc970-f49c-4e24-84f8-41ef45f7c4b0-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/Snowflake/Package/testParameters.json b/Solutions/Snowflake/Package/testParameters.json index cd283e750cf..84ec110e772 100644 --- a/Solutions/Snowflake/Package/testParameters.json +++ b/Solutions/Snowflake/Package/testParameters.json @@ -42,5 +42,47 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployHuntingQuery": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel hunting queries carried by this solution." + } + }, + "DeployParser": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the parsers and their registrations carried by this solution." + } } } diff --git a/Solutions/Snowflake/ReleaseNotes.md b/Solutions/Snowflake/ReleaseNotes.md index 59e5393ba57..add6bdfacc3 100644 --- a/Solutions/Snowflake/ReleaseNotes.md +++ b/Solutions/Snowflake/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| +| 3.2.2 | 20-10-2026 | Added ten disabled Defender XDR Custom Detections alongside the existing Microsoft Sentinel content. Defender Workbook drafts remain excluded pending review. | | 3.2.0 | 22-09-2026 | Added V3 Snowflake tables for nested ingestion. | | 3.1.0 | 04-08-2026 | Updated **CCF Data Connector** to fix pagination and migrate to V2 tables | | 3.0.9 | 03-02-2026 | Updated the **analytic rule** query.| diff --git a/Solutions/Snowflake/SolutionMetadata.json b/Solutions/Snowflake/SolutionMetadata.json index ca525616dd0..093dc2db3eb 100644 --- a/Solutions/Snowflake/SolutionMetadata.json +++ b/Solutions/Snowflake/SolutionMetadata.json @@ -1,15 +1,21 @@ { - "publisherId": "azuresentinel", - "offerId": "azure-sentinel-solution-snowflake", - "firstPublishDate": "2021-10-23", - "providers": ["Snowflake"], - "categories": { - "domains" : ["Application"] - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } -} \ No newline at end of file + "trackingId": "pid-951bc970-f49c-4e24-84f8-41ef45f7c4b0-partnercenter", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-snowflake", + "firstPublishDate": "2021-10-23", + "providers": [ + "Snowflake" + ], + "categories": { + "domains": [ + "Application" + ] + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "version": "3.2.2" +} diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeDiscoveryActivity.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeDiscoveryActivity.yaml new file mode 100644 index 00000000000..5d6211187c9 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeDiscoveryActivity.yaml @@ -0,0 +1,1905 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 09b8dfc7-87b0-4215-b34b-bab363d685cb + path: Analytic Rules/SnowflakeDiscoveryActivity.yaml + version: 3.2.1 + querySha256: a023f3143dd0769525b5ffcc99329663eadc6d0c2155f07a7e2e6f69a09731fa + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Discovery + originalTechniques: + - T1526 + reviewScope: + sourceDocumentSha256: a554a9b2927c77b3eece7d6a4e8beb75ffbb79ca664e44c6dcc43b08e570d8e2 + targetQuerySha256: 65b959bb8ba9410273248b99aac937600de1c2ec56ed04d88f3be3dad6c19be0 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: a554a9b2927c77b3eece7d6a4e8beb75ffbb79ca664e44c6dcc43b08e570d8e2 + targetQuerySha256: 65b959bb8ba9410273248b99aac937600de1c2ec56ed04d88f3be3dad6c19be0 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: a554a9b2927c77b3eece7d6a4e8beb75ffbb79ca664e44c6dcc43b08e570d8e2 + targetQuerySha256: 65b959bb8ba9410273248b99aac937600de1c2ec56ed04d88f3be3dad6c19be0 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: a554a9b2927c77b3eece7d6a4e8beb75ffbb79ca664e44c6dcc43b08e570d8e2 + targetQuerySha256: 65b959bb8ba9410273248b99aac937600de1c2ec56ed04d88f3be3dad6c19be0 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-09b8dfc7-87b0-4215-b34b-bab363d685cb + displayName: Snowflake - Possible discovery activity + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 20; + __xdr_inline_Snowflake + | where QueryType =~ 'SHOW' + | where QueryExecutionStatus =~ 'SUCCESS' + | summarize count() by TargetUsername, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Possible discovery activity + description: '''Detects possible discovery activity.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Discovery + techniques: + - technique: T1526 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeLongQueryProcessTime.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeLongQueryProcessTime.yaml new file mode 100644 index 00000000000..7d5dcb3ca6d --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeLongQueryProcessTime.yaml @@ -0,0 +1,1901 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 1376f5e5-855a-4f88-8591-19eba4575a0f + path: Analytic Rules/SnowflakeLongQueryProcessTime.yaml + version: 3.2.1 + querySha256: fee040321f8c00382b135488f65934f404221e11db313292aa9fb3a6e61a2fee + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1499 + reviewScope: + sourceDocumentSha256: 62ae60b36433f806fd3ecdd17241ad8094719402c4d3f9e78d2e2003969b7f42 + targetQuerySha256: 6aacccbbd719c178f96a0fa17e29bafccac19cb741b64611c736e81d2949194f + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: 62ae60b36433f806fd3ecdd17241ad8094719402c4d3f9e78d2e2003969b7f42 + targetQuerySha256: 6aacccbbd719c178f96a0fa17e29bafccac19cb741b64611c736e81d2949194f + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: 62ae60b36433f806fd3ecdd17241ad8094719402c4d3f9e78d2e2003969b7f42 + targetQuerySha256: 6aacccbbd719c178f96a0fa17e29bafccac19cb741b64611c736e81d2949194f + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 62ae60b36433f806fd3ecdd17241ad8094719402c4d3f9e78d2e2003969b7f42 + targetQuerySha256: 6aacccbbd719c178f96a0fa17e29bafccac19cb741b64611c736e81d2949194f + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-1376f5e5-855a-4f88-8591-19eba4575a0f + displayName: Snowflake - Abnormal query process time + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 10000; + __xdr_inline_Snowflake + | where QueryTotalElapsedTime > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Abnormal query process time + description: '''Detects query with abnormal proccess time.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Impact + techniques: + - technique: T1499 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeMultipleFailedQueries.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleFailedQueries.yaml new file mode 100644 index 00000000000..a3f50884c8f --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleFailedQueries.yaml @@ -0,0 +1,1907 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8 + path: Analytic Rules/SnowflakeMultipleFailedQueries.yaml + version: 3.2.1 + querySha256: 47408aecd3f63b9c96509b776f918f9c671d372f4cc143a689db43f23a2a9b02 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Discovery + originalTechniques: + - T1518 + - T1082 + reviewScope: + sourceDocumentSha256: e0c858c66dacf92aef1bfbec3fe62c61b075661f616b2c98e67d5da5931c35a2 + targetQuerySha256: 2cc6ce4ae525b4c3ace462286a9cde612c5182183ff28162cf9c3df4c8bd6e14 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: e0c858c66dacf92aef1bfbec3fe62c61b075661f616b2c98e67d5da5931c35a2 + targetQuerySha256: 2cc6ce4ae525b4c3ace462286a9cde612c5182183ff28162cf9c3df4c8bd6e14 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: e0c858c66dacf92aef1bfbec3fe62c61b075661f616b2c98e67d5da5931c35a2 + targetQuerySha256: 2cc6ce4ae525b4c3ace462286a9cde612c5182183ff28162cf9c3df4c8bd6e14 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: e0c858c66dacf92aef1bfbec3fe62c61b075661f616b2c98e67d5da5931c35a2 + targetQuerySha256: 2cc6ce4ae525b4c3ace462286a9cde612c5182183ff28162cf9c3df4c8bd6e14 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-5f8a81d9-7d27-4ff5-a0ce-4285ee02c2c8 + displayName: Snowflake - Multiple failed queries + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 50; + __xdr_inline_Snowflake + | where isnotempty(QueryExecutionStatus) + | where QueryExecutionStatus !~ 'SUCCESS' + | summarize count() by TargetUsername, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Multiple failed queries + description: '''Detects multiple failed queries in short timeframe.''' + severity: high + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Discovery + techniques: + - technique: T1518 + - technique: T1082 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailure.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailure.yaml new file mode 100644 index 00000000000..b1c13758e94 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailure.yaml @@ -0,0 +1,1905 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: e05cc333-d499-430f-907c-7f28a9e4d1b5 + path: Analytic Rules/SnowflakeMultipleLoginFailure.yaml + version: 3.2.1 + querySha256: 686f7f65d5ea5223a1a5c4a66fc07b9ef5cac19358f478b15653605a57da3788 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - InitialAccess + originalTechniques: + - T1078 + reviewScope: + sourceDocumentSha256: f153bcb47bda2bc0bcdaef9974aa11640a121fb6a964cbf337fc5f6e0474d213 + targetQuerySha256: a8b80e61897073a38d07afc383d6cdd1688db2f86f7bbd9d7da08360c38df2da + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: f153bcb47bda2bc0bcdaef9974aa11640a121fb6a964cbf337fc5f6e0474d213 + targetQuerySha256: a8b80e61897073a38d07afc383d6cdd1688db2f86f7bbd9d7da08360c38df2da + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: f153bcb47bda2bc0bcdaef9974aa11640a121fb6a964cbf337fc5f6e0474d213 + targetQuerySha256: a8b80e61897073a38d07afc383d6cdd1688db2f86f7bbd9d7da08360c38df2da + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: f153bcb47bda2bc0bcdaef9974aa11640a121fb6a964cbf337fc5f6e0474d213 + targetQuerySha256: a8b80e61897073a38d07afc383d6cdd1688db2f86f7bbd9d7da08360c38df2da + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-e05cc333-d499-430f-907c-7f28a9e4d1b5 + displayName: Snowflake - Multiple login failures by user + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 10; + __xdr_inline_Snowflake + | where EventType =~ 'LOGIN' + | where LoginIsSuccess =~ 'No' + | summarize count() by TargetUsername, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Multiple login failures by user + description: '''Detects multiple login failures by user.''' + severity: high + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: InitialAccess + techniques: + - technique: T1078 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailureFromIP.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailureFromIP.yaml new file mode 100644 index 00000000000..3fba5609b6b --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeMultipleLoginFailureFromIP.yaml @@ -0,0 +1,1886 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: b7d22407-1391-4256-b09a-414a9719443c + path: Analytic Rules/SnowflakeMultipleLoginFailureFromIP.yaml + version: 3.2.1 + querySha256: ffd706869b970307288b0874a8b64ef1320e0ef8689e14cc7a57258d813ed907 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: [] + errors: [] + originalTactics: + - InitialAccess + originalTechniques: + - T1078 + reviewScope: + sourceDocumentSha256: b2ea390295d61c68c3ab7538ddffe618c477a1c8266a07ee43354d6419787641 + targetQuerySha256: 069137e67a16f0147700044d7b90ff9f4a2c00bb2db37506684a5d5b1d3e038b + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: b2ea390295d61c68c3ab7538ddffe618c477a1c8266a07ee43354d6419787641 + targetQuerySha256: 069137e67a16f0147700044d7b90ff9f4a2c00bb2db37506684a5d5b1d3e038b + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: b2ea390295d61c68c3ab7538ddffe618c477a1c8266a07ee43354d6419787641 + targetQuerySha256: 069137e67a16f0147700044d7b90ff9f4a2c00bb2db37506684a5d5b1d3e038b + acceptedReviewReasons: + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-b7d22407-1391-4256-b09a-414a9719443c + displayName: Snowflake - Multiple login failures from single IP + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 10; + __xdr_inline_Snowflake + | where EventType =~ 'LOGIN' + | where LoginIsSuccess =~ 'No' + | summarize count() by SrcDvcIpAddr, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend IPCustomEntity = SrcDvcIpAddr + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Multiple login failures from single IP + description: '''Detects Mmltiple login failures from single IP.''' + severity: high + entityMappings: + ips: + - id: ip1 + addressColumn: IPCustomEntity + tactics: + - tactic: InitialAccess + techniques: + - technique: T1078 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakePossibleDataDestruction.yaml b/Solutions/Snowflake/XDR Detections/SnowflakePossibleDataDestruction.yaml new file mode 100644 index 00000000000..f293ab0dcf8 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakePossibleDataDestruction.yaml @@ -0,0 +1,1905 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: c2f93727-e4b0-4cb9-8f80-f52ebbd96ece + path: Analytic Rules/SnowflakePossibleDataDestruction.yaml + version: 3.2.1 + querySha256: 0d95c4e8d4ff8ea489805ad78ac9051f927b7ed46dcbab83ad9621d99f382185 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Impact + originalTechniques: + - T1485 + reviewScope: + sourceDocumentSha256: f52bb3503b7558bd95b70cbdb9b8791d3d3814886ad44ac25487b8522eaed33f + targetQuerySha256: d171b176c886aacea2906ddcc597c7784b0ef4c4d50e63b7621f5cef2e402156 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: f52bb3503b7558bd95b70cbdb9b8791d3d3814886ad44ac25487b8522eaed33f + targetQuerySha256: d171b176c886aacea2906ddcc597c7784b0ef4c4d50e63b7621f5cef2e402156 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: f52bb3503b7558bd95b70cbdb9b8791d3d3814886ad44ac25487b8522eaed33f + targetQuerySha256: d171b176c886aacea2906ddcc597c7784b0ef4c4d50e63b7621f5cef2e402156 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: f52bb3503b7558bd95b70cbdb9b8791d3d3814886ad44ac25487b8522eaed33f + targetQuerySha256: d171b176c886aacea2906ddcc597c7784b0ef4c4d50e63b7621f5cef2e402156 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-c2f93727-e4b0-4cb9-8f80-f52ebbd96ece + displayName: Snowflake - Possible data destraction + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let threshold = 10; + __xdr_inline_Snowflake + | where QueryType =~ 'DROP' + | where QueryExecutionStatus =~ 'SUCCESS' + | summarize count() by TargetUsername, bin(TimeGenerated, 5m) + | where count_ > threshold + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Possible data destraction + description: '''Detects possible data destruction.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Impact + techniques: + - technique: T1485 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakePrivilegesDiscovery.yaml b/Solutions/Snowflake/XDR Detections/SnowflakePrivilegesDiscovery.yaml new file mode 100644 index 00000000000..a73025c4364 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakePrivilegesDiscovery.yaml @@ -0,0 +1,1901 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 627a4ff1-036b-4375-a9f9-288d5e1d7d37 + path: Analytic Rules/SnowflakePrivilegesDiscovery.yaml + version: 3.2.1 + querySha256: 30a897fff1248a1c3402588d655ac7231de523211161e635dcc63baf14f56252 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Discovery + originalTechniques: + - T1087 + reviewScope: + sourceDocumentSha256: 9bfe49e64a860328b337b30eb39e1a79568590fb1a6d38cb7fd87cb8462c829c + targetQuerySha256: 172104a2338b272f8189c483e17e9f2f4bd46b4a2d336952f982076e4e05136e + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: 9bfe49e64a860328b337b30eb39e1a79568590fb1a6d38cb7fd87cb8462c829c + targetQuerySha256: 172104a2338b272f8189c483e17e9f2f4bd46b4a2d336952f982076e4e05136e + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: 9bfe49e64a860328b337b30eb39e1a79568590fb1a6d38cb7fd87cb8462c829c + targetQuerySha256: 172104a2338b272f8189c483e17e9f2f4bd46b4a2d336952f982076e4e05136e + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 9bfe49e64a860328b337b30eb39e1a79568590fb1a6d38cb7fd87cb8462c829c + targetQuerySha256: 172104a2338b272f8189c483e17e9f2f4bd46b4a2d336952f982076e4e05136e + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-627a4ff1-036b-4375-a9f9-288d5e1d7d37 + displayName: Snowflake - Possible privileges discovery activity + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + __xdr_inline_Snowflake + | where QueryType =~ 'SHOW' + | where QueryText has_all ('SHOW', 'ROLES') + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Possible privileges discovery activity + description: '''Detects possible privileges discovery activity.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Discovery + techniques: + - technique: T1087 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeQueryOnSensitiveTable.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeQueryOnSensitiveTable.yaml new file mode 100644 index 00000000000..8bfc93de3e1 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeQueryOnSensitiveTable.yaml @@ -0,0 +1,1904 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e + path: Analytic Rules/SnowflakeQueryOnSensitiveTable.yaml + version: 3.2.1 + querySha256: 9ea4485f5dcc454a558fdaf3c747c5a9a6ecc4d87326a98cf07cece2ff6ef67d + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Collection + originalTechniques: + - T1119 + reviewScope: + sourceDocumentSha256: 846a2daa3cdb2993f93ac04a9714f30fa4134b01c6dcf1dfa2a0430c6d999a36 + targetQuerySha256: a9206e1eb84ea496746f6e8f9af4ac9ba35946d94cf8839d42f1ddee42a69e8c + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: 846a2daa3cdb2993f93ac04a9714f30fa4134b01c6dcf1dfa2a0430c6d999a36 + targetQuerySha256: a9206e1eb84ea496746f6e8f9af4ac9ba35946d94cf8839d42f1ddee42a69e8c + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: 846a2daa3cdb2993f93ac04a9714f30fa4134b01c6dcf1dfa2a0430c6d999a36 + targetQuerySha256: a9206e1eb84ea496746f6e8f9af4ac9ba35946d94cf8839d42f1ddee42a69e8c + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 846a2daa3cdb2993f93ac04a9714f30fa4134b01c6dcf1dfa2a0430c6d999a36 + targetQuerySha256: a9206e1eb84ea496746f6e8f9af4ac9ba35946d94cf8839d42f1ddee42a69e8c + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-f258fa0c-e26c-4e2b-94fb-88b6cef0ca6e + displayName: Snowflake - Query on sensitive or restricted table + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let r_tbl = dynamic(['table_name']); + __xdr_inline_Snowflake + | where QueryType =~ 'SELECT' + | where QueryExecutionStatus =~ 'SUCCESS' + | extend tbl = extract(@'(FROM|from)\s(\S+)\s', 2, QueryText) + | where tbl in~ (r_tbl) + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Query on sensitive or restricted table + description: '''Detects query on sensitive or restricted table.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Collection + techniques: + - technique: T1119 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeUnusualQuery.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeUnusualQuery.yaml new file mode 100644 index 00000000000..d68e24525fa --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeUnusualQuery.yaml @@ -0,0 +1,1902 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 1dd1d9e5-3ebf-43cb-be07-6082d5eabe79 + path: Analytic Rules/SnowflakeUnusualQuery.yaml + version: 3.2.1 + querySha256: a2d086708eb294a2a80434596dc005458ce34e020881852047ed448a262e21a3 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - Collection + originalTechniques: + - T1119 + reviewScope: + sourceDocumentSha256: 300127b3df5549a4465120ec6018da6fa3f83b33bfd507e3eae17a40ed8eb8f2 + targetQuerySha256: b9ddc96cc133e8c9fd1c34e91afa039c93251192768f1f29702d4d308015c4f9 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: 300127b3df5549a4465120ec6018da6fa3f83b33bfd507e3eae17a40ed8eb8f2 + targetQuerySha256: b9ddc96cc133e8c9fd1c34e91afa039c93251192768f1f29702d4d308015c4f9 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: 300127b3df5549a4465120ec6018da6fa3f83b33bfd507e3eae17a40ed8eb8f2 + targetQuerySha256: b9ddc96cc133e8c9fd1c34e91afa039c93251192768f1f29702d4d308015c4f9 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: 300127b3df5549a4465120ec6018da6fa3f83b33bfd507e3eae17a40ed8eb8f2 + targetQuerySha256: b9ddc96cc133e8c9fd1c34e91afa039c93251192768f1f29702d4d308015c4f9 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-1dd1d9e5-3ebf-43cb-be07-6082d5eabe79 + displayName: Snowflake - Unusual query + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + __xdr_inline_Snowflake + | where QueryType =~ 'SELECT' + | where QueryExecutionStatus =~ 'SUCCESS' + | where QueryText startswith @'SELECT *' + | extend AccountCustomEntity = TargetUsername + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - Unusual query + description: '''Detects unusual query.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: Collection + techniques: + - technique: T1119 diff --git a/Solutions/Snowflake/XDR Detections/SnowflakeUserAddAdminPrivileges.yaml b/Solutions/Snowflake/XDR Detections/SnowflakeUserAddAdminPrivileges.yaml new file mode 100644 index 00000000000..b3c7dde6178 --- /dev/null +++ b/Solutions/Snowflake/XDR Detections/SnowflakeUserAddAdminPrivileges.yaml @@ -0,0 +1,1905 @@ +schemaVersion: 1.0.0 +version: 3.2.1 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: Snowflake + dataTypes: + - Snowflake +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - Snowflake_CL + - SnowflakeLoad_CL + - SnowflakeLoadV2_CL + - SnowflakeLoadV3_CL + - SnowflakeLogin_CL + - SnowflakeLoginV2_CL + - SnowflakeLoginV3_CL + - SnowflakeMaterializedView_CL + - SnowflakeMaterializedViewV2_CL + - SnowflakeMaterializedViewV3_CL + - SnowflakeQuery_CL + - SnowflakeQueryV2_CL + - SnowflakeQueryV3_CL + - SnowflakeRoleGrant_CL + - SnowflakeRoleGrantV2_CL + - SnowflakeRoleGrantV3_CL + - SnowflakeRoles_CL + - SnowflakeRolesV2_CL + - SnowflakeRolesV3_CL + - SnowflakeTableStorageMetrics_CL + - SnowflakeTableStorageMetricsV2_CL + - SnowflakeTableStorageMetricsV3_CL + - SnowflakeTables_CL + - SnowflakeTablesV2_CL + - SnowflakeTablesV3_CL + - SnowflakeUserGrant_CL + - SnowflakeUserGrantV2_CL + - SnowflakeUserGrantV3_CL + - SnowflakeUsers_CL + - SnowflakeUsersV2_CL + - SnowflakeUsersV3_CL + requiredDataConnectors: + - connectorId: Snowflake + dataTypes: + - Snowflake + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 5ed33eee-0ab6-4bf5-9e9b-6100db83d39a + path: Analytic Rules/SnowflakeUserAddAdminPrivileges.yaml + version: 3.2.1 + querySha256: a3def4a92021b8c66c193f39c3e0d0faf56a3d5d06233d26e4e17499dd5ee235 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - isfuzzy unions can still fail semantic binding in Advanced Hunting + - Renamed local parser binding Snowflake to __xdr_inline_Snowflake to avoid a saved parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - Account.Name output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + informational: [] + errors: [] + originalTactics: + - PrivilegeEscalation + originalTechniques: + - T1078 + reviewScope: + sourceDocumentSha256: dc2ed76b4ed3befbb5ce39c8d9412d298882b517dadc0786bdd80075c4180cd1 + targetQuerySha256: e58768ad5172346b91f015d704b5043c4de587e98a669beb1702010361817013 + reviewDecisions: + - reason: isfuzzy unions can still fail semantic binding in Advanced Hunting + decision: accepted + sourceDocumentSha256: dc2ed76b4ed3befbb5ce39c8d9412d298882b517dadc0786bdd80075c4180cd1 + targetQuerySha256: e58768ad5172346b91f015d704b5043c4de587e98a669beb1702010361817013 + - reason: 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm + that the source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + decision: accepted + sourceDocumentSha256: dc2ed76b4ed3befbb5ce39c8d9412d298882b517dadc0786bdd80075c4180cd1 + targetQuerySha256: e58768ad5172346b91f015d704b5043c4de587e98a669beb1702010361817013 + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: false + aggregationWindowDifference: false + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: No summarize/make-series aggregation detected in query; native 4-hour XDR lookback relies on + Defender XDR alert deduplication across hourly runs. + sourceDocumentSha256: dc2ed76b4ed3befbb5ce39c8d9412d298882b517dadc0786bdd80075c4180cd1 + targetQuerySha256: e58768ad5172346b91f015d704b5043c4de587e98a669beb1702010361817013 + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: Name + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Entity confirmation required: `AccountCustomEntity` was provisionally mapped to Account.upnColumn. Confirm that the + source always emits a complete UPN; otherwise project an Entra user ID, SID, or account name plus domain' + - isfuzzy unions can still fail semantic binding in Advanced Hunting +properties: + id: xdr-5ed33eee-0ab6-4bf5-9e9b-6100db83d39a + displayName: Snowflake - User granted admin privileges + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_Snowflake = view () { + let Snowflake_view = view () { + Snowflake_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + EventStartTime = column_ifexists('START_TIME_t', ''), + EventType = column_ifexists('EVENT_TYPE_s', ''), + TargetUsername = column_ifexists('USER_NAME_s', ''), + SrcDvcIpAddr = column_ifexists('CLIENT_IP_s', ''), + QueryType = column_ifexists('QUERY_TYPE_s', ''), + QueryText = column_ifexists('QUERY_TEXT_s', ''), + QueryExecutionStatus = column_ifexists('EXECUTION_STATUS_s', ''), + QueryTotalElapsedTime = toreal(column_ifexists('TOTAL_ELAPSED_TIME_d', '0')), + LoginIsSuccess = column_ifexists('IS_SUCCESS_s', ''), + QueryCreditsUsedCloudServices = iff(isempty(CREDITS_USED_CLOUD_SERVICES_d), toreal(0), toreal(CREDITS_USED_CLOUD_SERVICES_d)), + QueryExecutionTime = toreal(column_ifexists('EXECUTION_TIME_d', '0')), + RoleName = column_ifexists('ROLE_NAME_s', '') + | extend + User = TargetUsername, + EventEndTime = iff(isnotempty(EVENT_TIMESTAMP_t), EVENT_TIMESTAMP_t, END_TIME_t) + }; + let SnowflakeLogin_view = view () { + SnowflakeLogin_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend Time = extractjson("$.EVENT_TIMESTAMP", JsonString) + | extend + SrcDvcIpAddr = extractjson("$.CLIENT_IP", JsonString), + LoginClientPrivateLinkId = extractjson("$.CLIENT_PRIVATE_LINK_ID", JsonString), + LoginConnection = extractjson("$.CONNECTION", JsonString), + LoginErrorCode = extractjson("$.ERROR_CODE", JsonString), + LoginErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + LoginEventId = extractjson("$.EVENT_ID", JsonString), + LoginEventEndTime = todatetime(substring(Time, 0, 23)) - tolong(substring(Time, 24, 3)) * 1h, + LoginEventType = extractjson("$.EVENT_TYPE", JsonString), + LoginFirstAuthenticationFactor = extractjson("$.FIRST_AUTHENTICATION_FACTOR", JsonString), + LoginIsSuccess = extractjson("$.IS_SUCCESS", JsonString), + LoginRelatedEventId = extractjson("$.RELATED_EVENT_ID", JsonString), + LoginReportedClientType = extractjson("$.REPORTED_CLIENT_TYPE", JsonString), + LoginReportedClientVersion = extractjson("$.REPORTED_CLIENT_VERSION", JsonString), + LoginSecondAuthenticationFactor = extractjson("$.SECOND_AUTHENTICATION_FACTOR", JsonString), + TargetUsername = extractjson("$.USER_NAME", JsonString) + | extend User = TargetUsername + }; + let SnowflakeUserGrant_view = view () { + SnowflakeUserGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + UserGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserRole = extractjson("$.ROLE", JsonString), + UserGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + UserGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + UserGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString) + }; + let SnowflakeMaterializedView_view = view () { + SnowflakeMaterializedView_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + STime = extractjson("$.START_TIME", JsonString), + ETime = extractjson("$.END_TIME", JsonString) + | extend + MaterializedViewStartTime = todatetime(substring(STime, 0, 23)) - tolong(substring(STime, 24, 3)) * 1h, + MaterializedViewEndTime = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + MaterializedViewCreditsUsed = extractjson("$.CREDITS_USED", JsonString), + MaterializedViewTableId = extractjson("$.TABLE_ID", JsonString), + MaterializedViewTableName = extractjson("$.TABLE_NAME", JsonString), + MaterializedViewSchemaId = extractjson("$.SCHEMA_ID", JsonString), + MaterializedViewSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + MaterializedViewDatabaseId = extractjson("$.DATABASE_ID", JsonString), + MaterializedViewDatabaseName = extractjson("$.DATABASE_NAME", JsonString) + }; + let SnowflakeRoles_view = view () { + SnowflakeRoles_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleId = extractjson("$.ROLE_ID", JsonString), + RoleCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleName = extractjson("$.NAME", JsonString), + RoleComment = extractjson("$.COMMENT", JsonString), + RoleOwner = extractjson("$.OWNER", JsonString), + RoleType = extractjson("$.ROLE_TYPE", JsonString), + RoleDatabaseName = extractjson("$.ROLE_DATABASE_NAME", JsonString), + RoleInstanceId = extractjson("$.ROLE_INSTANCE_ID", JsonString), + OwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString) + }; + let SnowflakeRoleGrant_view = view () { + SnowflakeRoleGrant_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + MTime = extractjson("$.MODIFIED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString) + | extend + RoleGrantCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + RoleGrantModifiedOn = todatetime(substring(MTime, 0, 23)) - tolong(substring(MTime, 24, 3)) * 1h, + RoleGrantPrivilege = extractjson("$.PRIVILEGE", JsonString), + RoleGrantGrantedOn = extractjson("$.GRANTED_ON", JsonString), + RoleGrantName = extractjson("$.NAME", JsonString), + RoleGrantTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + RoleGrantTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + RoleGrantGrantedTo = extractjson("$.GRANTED_TO", JsonString), + RoleGrantGranteeName = extractjson("$.GRANTEE_NAME", JsonString), + RoleGrantGrantOption = extractjson("$.GRANT_OPTION", JsonString), + RoleGrantGrantedBy = extractjson("$.GRANTED_BY", JsonString), + RoleGrantDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + RoleGrantGrantedByRoleType = extractjson("$.GRANTED_BY_ROLE_TYPE", JsonString), + RoleGrantObjectInstance = extractjson("$.OBJECT_INSTANCE", JsonString) + }; + let SnowflakeLoad_view = view () { + SnowflakeLoad_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend LTime = extractjson("$.LAST_LOAD_TIME", JsonString) + | extend + LoadTableId = extractjson("$.TABLE_ID", JsonString), + LoadTableName = extractjson("$.TABLE_NAME", JsonString), + LoadSchemaId = extractjson("$.SCHEMA_ID", JsonString), + LoadSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + LoadCatalogId = extractjson("$.CATALOG_ID", JsonString), + LoadCatalogName = extractjson("$.CATALOG_NAME", JsonString), + LoadFileName = extractjson("$.FILE_NAME", JsonString), + LoadLastLoadTime = todatetime(substring(LTime, 0, 23)) - tolong(substring(LTime, 24, 3)) * 1h, + LoadStatus = extractjson("$.STATUS", JsonString), + LoadRowCount = extractjson("$.ROW_COUNT", JsonString), + LoadRowParsed = extractjson("$.ROW_PARSED", JsonString), + LoadFirstErrorMessage = extractjson("$.FIRST_ERROR_MESSAGE", JsonString), + LoadFirstErrorLineNumber = extractjson("$.FIRST_ERROR_LINE_NUMBER", JsonString), + LoadFirstErrorCharacterPosition = extractjson("$.FIRST_ERROR_CHARACTER_POSITION", JsonString), + LoadFirstErrorColName = extractjson("$.FIRST_ERROR_COL_NAME", JsonString), + LoadErrorCount = extractjson("$.ERROR_COUNT", JsonString), + LoadErrorLimit = extractjson("$.ERROR_LIMIT", JsonString) + }; + let SnowflakeTableStorageMetrics_view = view () { + SnowflakeTableStorageMetrics_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.TABLE_CREATED", JsonString), + TDTime = extractjson("$.TABLE_DROPPED", JsonString), + TFTime = extractjson("$.TABLE_ENTERED_FAILSAFE", JsonString), + SCTime = extractjson("$.SCHEMA_CREATED", JsonString), + SDTime = extractjson("$.SCHEMA_DROPPED", JsonString), + CCTime = extractjson("$.CATALOG_CREATED", JsonString), + CDTime = extractjson("$.CATALOG_DROPPED", JsonString) + | extend + TableStorageMetricsId = extractjson("$.ID", JsonString), + TableStorageMetricsTableName = extractjson("$.TABLE_NAME", JsonString), + TableStorageMetricsTableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableStorageMetricsTableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableStorageMetricsTableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableStorageMetricsTableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableStorageMetricsCloneGroupId = extractjson("$.CLONE_GROUP_ID", JsonString), + TableStorageMetricsIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableStorageMetricsActiveBytes = extractjson("$.ACTIVE_BYTES", JsonString), + TableStorageMetricsTimeTravelBytes = extractjson("$.TIME_TRAVEL_BYTES", JsonString), + TableStorageMetricsFailsafeBytes = extractjson("$.FAILSAFE_BYTES", JsonString), + TableStorageMetricsRetainedForCloneBytes = extractjson("$.RETAINED_FOR_CLONE_BYTES", JsonString), + TableStorageMetricsDeleted = extractjson("$.DELETED", JsonString), + TableStorageMetricsTableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableStorageMetricsTableDropped = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableStorageMetricsTableEnteredFailsafe = todatetime(substring(TFTime, 0, 23)) - tolong(substring(TFTime, 24, 3)) * 1h, + TableStorageMetricsSchemaCreated = todatetime(substring(SCTime, 0, 23)) - tolong(substring(SCTime, 24, 3)) * 1h, + TableStorageMetricsSchemaDropped = todatetime(substring(SDTime, 0, 23)) - tolong(substring(SDTime, 24, 3)) * 1h, + TableStorageMetricsCatalogCreated = todatetime(substring(CCTime, 0, 23)) - tolong(substring(CCTime, 24, 3)) * 1h, + TableStorageMetricsCatalogDropped = todatetime(substring(CDTime, 0, 23)) - tolong(substring(CDTime, 24, 3)) * 1h, + TableStorageMetricsComment = extractjson("$.COMMENT", JsonString), + TableStorageMetricsInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeTables_view = view () { + SnowflakeTables_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + TCTime = extractjson("$.CREATED", JsonString), + LATime = extractjson("$.LAST_ALTERED", JsonString), + LDTime = extractjson("$.LAST_DDL", JsonString), + TDTime = extractjson("$.DELETED", JsonString) + | extend + TableId = extractjson("$.TABLE_ID", JsonString), + TableName = extractjson("$.TABLE_NAME", JsonString), + TableSchemaId = extractjson("$.TABLE_SCHEMA_ID", JsonString), + TableSchema = extractjson("$.TABLE_SCHEMA", JsonString), + TableCatalogId = extractjson("$.TABLE_CATALOG_ID", JsonString), + TableCatalog = extractjson("$.TABLE_CATALOG", JsonString), + TableOwner = extractjson("$.TABLE_OWNER", JsonString), + TableType = extractjson("$.TABLE_TYPE", JsonString), + TableIsTransient = extractjson("$.IS_TRANSIENT", JsonString), + TableIsIceberg = extractjson("$.IS_ICEBERG", JsonString), + TableIsDynamic = extractjson("$.IS_DYNAMIC", JsonString), + TableIsHybrid = extractjson("$.IS_HYBRID", JsonString), + TableClusteringKey = extractjson("$.CLUSTERING_KEY", JsonString), + TableRowCount = extractjson("$.ROW_COUNT", JsonString), + TableBytes = extractjson("$.BYTES", JsonString), + TableRetentionTime = extractjson("$.RETENTION_TIME", JsonString), + TableSelfReferencingColumnName = extractjson("$.SELF_REFERENCING_COLUMN_NAME", JsonString), + TableReferenceGeneration = extractjson("$.REFERENCE_GENERATION", JsonString), + TableUserDefinedTypeCatalog = extractjson("$.USER_DEFINED_TYPE_CATALOG", JsonString), + TableUserDefinedTypeSchema = extractjson("$.USER_DEFINED_TYPE_SCHEMA", JsonString), + TableUserDefinedTypeName = extractjson("$.USER_DEFINED_TYPE_NAME", JsonString), + TableIsInsertableInto = extractjson("$.IS_INSERTABLE_INTO", JsonString), + TableIsTyped = extractjson("$.IS_TYPED", JsonString), + TableCommitAction = extractjson("$.COMMIT_ACTION", JsonString), + TableCreated = todatetime(substring(TCTime, 0, 23)) - tolong(substring(TCTime, 24, 3)) * 1h, + TableLastAltered = todatetime(substring(LATime, 0, 23)) - tolong(substring(LATime, 24, 3)) * 1h, + TableLastDDL = todatetime(substring(LDTime, 0, 23)) - tolong(substring(LDTime, 24, 3)) * 1h, + TableLastDDLBy = extractjson("$.LAST_DDL_BY", JsonString), + TableDeleted = todatetime(substring(TDTime, 0, 23)) - tolong(substring(TDTime, 24, 3)) * 1h, + TableAutoClusteringOn = extractjson("$.AUTO_CLUSTERING_ON", JsonString), + TableComment = extractjson("$.COMMENT", JsonString), + TableOwnerRoleType = extractjson("$.OWNER_ROLE_TYPE", JsonString), + TableInstanceId = extractjson("$.INSTANCE_ID", JsonString) + }; + let SnowflakeUsers_view = view () { + SnowflakeUsers_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + CTime = extractjson("$.CREATED_ON", JsonString), + DTime = extractjson("$.DELETED_ON", JsonString), + BMTime = extractjson("$.BYPASS_MFA_UNTIL", JsonString), + LSLTime = extractjson("$.LAST_SUCCESS_LOGIN", JsonString), + ETime = extractjson("$.EXPIRES_AT", JsonString), + LUTime = extractjson("$.LOCKED_UNTIL_TIME", JsonString), + PLSTime = extractjson("$.PASSWORD_LAST_SET_TIME", JsonString) + | extend + UserId = extractjson("$.USER_ID", JsonString), + UserName = extractjson("$.NAME", JsonString), + UserCreatedOn = todatetime(substring(CTime, 0, 23)) - tolong(substring(CTime, 24, 3)) * 1h, + UserDeletedOn = todatetime(substring(DTime, 0, 23)) - tolong(substring(DTime, 24, 3)) * 1h, + UserLoginName = extractjson("$.LOGIN_NAME", JsonString), + UserDisplayName = extractjson("$.DISPLAY_NAME", JsonString), + UserFirstName = extractjson("$.FIRST_NAME", JsonString), + UserLastName = extractjson("$.LAST_NAME", JsonString), + UserEmail = extractjson("$.EMAIL", JsonString), + UserMustChangePassword = extractjson("$.MUST_CHANGE_PASSWORD", JsonString), + UserHasPassword = extractjson("$.HAS_PASSWORD", JsonString), + UserComment = extractjson("$.COMMENT", JsonString), + UserDisabled = extractjson("$.DISABLED", JsonString), + UserSnowflakeLock = extractjson("$.SNOWFLAKE_LOCK", JsonString), + UserDefaultWarehouse = extractjson("$.DEFAULT_WAREHOUSE", JsonString), + UserDefaultNamespace = extractjson("$.DEFAULT_NAMESPACE", JsonString), + UserDefaultRole = extractjson("$.DEFAULT_ROLE", JsonString), + UserExtAuthnDuo = extractjson("$.EXT_AUTHN_DUO", JsonString), + UserExtAuthnUid = extractjson("$.EXT_AUTHN_UID", JsonString), + UserHasMFA = extractjson("$.HAS_MFA", JsonString), + UserBypassMFAUntil = todatetime(substring(BMTime, 0, 23)) - tolong(substring(BMTime, 24, 3)) * 1h, + UserLastSuccessLogin = todatetime(substring(LSLTime, 0, 23)) - tolong(substring(LSLTime, 24, 3)) * 1h, + UserExpiresAt = todatetime(substring(ETime, 0, 23)) - tolong(substring(ETime, 24, 3)) * 1h, + UserLockedUntilTime = todatetime(substring(LUTime, 0, 23)) - tolong(substring(LUTime, 24, 3)) * 1h, + UserHasRSAPublicKey = extractjson("$.HAS_RSA_PUBLIC_KEY", JsonString), + UserPasswordLastSetTime = todatetime(substring(PLSTime, 0, 23)) - tolong(substring(PLSTime, 24, 3)) * 1h, + UserOwner = extractjson("$.OWNER", JsonString), + UserDefaultSecondaryRole = extractjson("$.DEFAULT_SECONDARY_ROLE", JsonString), + UserType = extractjson("$.TYPE", JsonString), + UserDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + UserDatabaseId = extractjson("$.DATABASE_ID", JsonString), + UserSchemaName = extractjson("$.SCHEMA_NAME", JsonString), + UserSchemaId = extractjson("$.SCHEMA_ID", JsonString) + }; + let SnowflakeQuery_view = view () { + SnowflakeQuery_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand OuterArray = todynamic(Data) + | mv-expand innerArray = OuterArray + | extend JsonString = tostring(innerArray) + | extend + QSTime = extractjson("$.START_TIME", JsonString), + QETime = extractjson("$.END_TIME", JsonString), + QueryTotalElapsedTime = toreal(extractjson("$.TOTAL_ELAPSED_TIME", JsonString)), + QueryExecutionTime = toreal(extractjson("$.EXECUTION_TIME", JsonString)) + | extend + QueryStartTime = todatetime(substring(QSTime, 0, 23)) - tolong(substring(QSTime, 24, 3)) * 1h, + QueryEndTime = todatetime(substring(QETime, 0, 23)) - tolong(substring(QETime, 24, 3)) * 1h + | extend + QueryId = extractjson("$.QUERY_ID", JsonString), + QueryText = extractjson("$.QUERY_TEXT", JsonString), + QueryDatabaseId = extractjson("$.DATABASE_ID", JsonString), + QueryDatabaseName = extractjson("$.DATABASE_NAME", JsonString), + QuerySchemaId = extractjson("$.SCHEMA_ID", JsonString), + QuerySchemaName = extractjson("$.SCHEMA_NAME", JsonString), + QueryType = extractjson("$.QUERY_TYPE", JsonString), + QuerySessionId = extractjson("$.SESSION_ID", JsonString), + QueryUserName = extractjson("$.USER_NAME", JsonString), + QueryRoleName = extractjson("$.ROLE_NAME", JsonString), + QueryWarehouseId = extractjson("$.WAREHOUSE_ID", JsonString), + QueryWarehouseName = extractjson("$.WAREHOUSE_NAME", JsonString), + QueryWarehouseSize = extractjson("$.WAREHOUSE_SIZE", JsonString), + QueryWarehouseType = extractjson("$.WAREHOUSE_TYPE", JsonString), + QueryClusterNumber = extractjson("$.CLUSTER_NUMBER", JsonString), + QueryTag = extractjson("$.TAG", JsonString), + QueryBytesScanned = extractjson("$.BYTES_SCANNED", JsonString), + QueryPercentageScannedFromCache = extractjson("$.PERCENTAGE_SCANNED_FROM_CACHE", JsonString), + QueryBytesWritten = extractjson("$.BYTES_WRITTEN", JsonString), + QueryBytesWrittenToResult = extractjson("$.BYTES_WRITTEN_TO_RESULT", JsonString), + QueryBytesReadFromResult = extractjson("$.BYTES_READ_FROM_RESULT", JsonString), + QueryRowsProduced = extractjson("$.ROWS_PRODUCED", JsonString), + QueryRowsInserted = extractjson("$.ROWS_INSERTED", JsonString), + QueryRowsUpdated = extractjson("$.ROWS_UPDATED", JsonString), + QueryRowsDeleted = extractjson("$.ROWS_DELETED", JsonString), + QueryRowsUnloaded = extractjson("$.ROWS_UNLOADED", JsonString), + QueryBytesDeleted = extractjson("$.BYTES_DELETED", JsonString), + QueryQueuedProvisioningTime = extractjson("$.PROVISIONING_TIME", JsonString), + QueryQueuedRepairTime = extractjson("$.QUEUED_REPAIR_TIME", JsonString), + QueryQueuedOverloadTime = extractjson("$.QUEUED_OVERLOAD_TIME", JsonString), + QueryTransactionBlockedTime = extractjson("$.TRANSACTION_BLOCKED_TIME", JsonString), + QueryOutboundDataTransferCloud = extractjson("$.OUTBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryOutboundDataTransferRegion = extractjson("$.OUTBOUND_DATA_TRANSFER_REGION", JsonString), + QueryOutboundDataTransferBytes = extractjson("$.OUTBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryInboundDataTransferCloud = extractjson("$.INBOUND_DATA_TRANSFER_CLOUD", JsonString), + QueryInboundDataTransferRegion = extractjson("$.INBOUND_DATA_TRANSFER_REGION", JsonString), + QueryInboundDataTransferBytes = extractjson("$.INBOUND_DATA_TRANSFER_BYTES", JsonString), + QueryPartitionsScanned = extractjson("$.PARTITIONS_SCANNED", JsonString), + QueryPartitionsTotal = extractjson("$.PARTITIONS_TOTAL", JsonString), + QueryBytesSpilledToLocalStorage = extractjson("$.BYTES_SPILLED_TO_LOCAL_STORAGE", JsonString), + QueryBytesSpilledToRemoteStorage = extractjson("$.BYTES_SPILLED_TO_REMOTE_STORAGE", JsonString), + QueryBytesSentOverTheNetwork = extractjson("$.BYTES_SENT_OVER_THE_NETWORK", JsonString), + QueryCompilationTime = extractjson("$.COMPILATION_TIME", JsonString), + QueryExecutionStatus = extractjson("$.EXECUTION_STATUS", JsonString), + QueryErrorCode = extractjson("$.ERROR_CODE", JsonString), + QueryErrorMessage = extractjson("$.ERROR_MESSAGE", JsonString), + QueryListExternalFilesTime = extractjson("$.LIST_EXTERNAL_FILES_TIME", JsonString), + QueryCreditsUsedCloudServices = iff(isempty(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString)), toreal(0), toreal(extractjson("$.CREDITS_USED_CLOUD_SERVICES", JsonString))), + QueryReleaseVersion = extractjson("$.RELEASE_VERSION", JsonString), + QueryExternalFunctionTotalInvocations = extractjson("$.EXTERNAL_FUNCTION_TOTAL_INVOCATIONS", JsonString), + QueryExternalFunctionTotalSentRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_ROWS", JsonString), + QueryExternalFunctionTotalReceivedRows = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_ROWS", JsonString), + QueryExternalFunctionTotalSentBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_SENT_BYTES", JsonString), + QueryExternalFunctionTotalReceivedBytes = extractjson("$.EXTERNAL_FUNCTION_TOTAL_RECEIVED_BYTES", JsonString), + QueryIsClientGeneratedStatement = extractjson("$.IS_CLIENT_GENERATED_STATEMENT", JsonString), + QueryAccelerationBytesScanned = extractjson("$.ACCELERATION_BYTES_SCANNED", JsonString), + QueryAccelerationPartitionsScanned = extractjson("$.ACCELERATION_PARTITIONS_SCANNED", JsonString), + QueryAccelerationUpperLimitScaleFactor = extractjson("$.ACCELERATION_UPPER_LIMIT_SCALE_FACTOR", JsonString), + QueryTransactionId = extractjson("$.TRANSACTION_ID", JsonString), + QueryLoadPercent = extractjson("$.QUERY_LOAD_PERCENT", JsonString), + ChildQueriesWaitTime = extractjson("$.CHILD_QUERIES_WAIT_TIME", JsonString), + QueryRoleType = extractjson("$.ROLE_TYPE", JsonString), + QueryHash = extractjson("$.HASH", JsonString), + QueryHashVersion = extractjson("$.HASH_VERSION", JsonString), + QueryParameterizedHash = extractjson("$.PARAMETERIZED_HASH", JsonString), + QueryParameterizedHashVersion = extractjson("$.PARAMETERIZED_HASH_VERSION", JsonString), + QuerySecondaryRoleStats = extractjson("$.SECONDARY_ROLE_STATS", JsonString), + QueryRowsWrittenToResult = extractjson("$.ROWS_WRITTEN_TO_RESULT", JsonString), + QueryRetryTime = extractjson("$.RETRY_TIME", JsonString), + QueryRetryCause = extractjson("$.RETRY_CAUSE", JsonString), + QueryFaultHandlingTime = extractjson("$.FAULT_HANDLING_TIME", JsonString), + QueryUserType = extractjson("$.USER_TYPE", JsonString), + QueryUserDatabaseName = extractjson("$.USER_DATABASE_NAME", JsonString), + QueryUserDatabaseId = extractjson("$.USER_DATABASE_ID", JsonString), + QueryUserSchemaId = extractjson("$.USER_SCHEMA_ID", JsonString), + QueryUserSchemaName = extractjson("$.USER_SCHEMA_NAME", JsonString) + }; + let SnowflakeLoginV2_view = view () { + SnowflakeLoginV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[1]) + | extend + LoginEventId = tostring(DataList[0]), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(DataList[2]), + LoginUserName = tostring(DataList[3]), + LoginClientIp = tostring(DataList[4]), + LoginReportedClientType = tostring(DataList[5]), + LoginReportedClientVersion = tostring(DataList[6]), + LoginFirstAuthenticationFactor = tostring(DataList[7]), + LoginSecondAuthenticationFactor = tostring(DataList[8]), + LoginIsSuccess = tostring(DataList[9]), + LoginErrorCode = tostring(DataList[10]), + LoginErrorMessage = tostring(DataList[11]), + LoginRelatedEventId = tostring(DataList[12]), + LoginConnection = tostring(DataList[13]), + LoginClientPrivateLinkId = tostring(DataList[14]), + LoginFirstAuthenticationFactorId = tostring(DataList[15]), + LoginSecondAuthenticationFactorId = tostring(DataList[16]), + LoginDetails = tostring(DataList[17]), + LoginAuthorizingIntegrationName = tostring(DataList[18]) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV2_view = view () { + SnowflakeUserGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + DTime = toreal(DataList[1]) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(DataList[2]), + UserGrantGrantedTo = tostring(DataList[3]), + UserGrantGranteeName = tostring(DataList[4]), + UserGrantGrantedBy = tostring(DataList[5]) + }; + let SnowflakeMaterializedViewV2_view = view () { + SnowflakeMaterializedViewV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + STime = toreal(DataList[0]), + ETime = toreal(DataList[1]) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(DataList[2]), + MaterializedViewTableId = tostring(DataList[3]), + MaterializedViewTableName = tostring(DataList[4]), + MaterializedViewSchemaId = tostring(DataList[5]), + MaterializedViewSchemaName = tostring(DataList[6]), + MaterializedViewDatabaseId = tostring(DataList[7]), + MaterializedViewDatabaseName = tostring(DataList[8]) + }; + let SnowflakeRolesV2_view = view () { + SnowflakeRolesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[1]), + DTime = toreal(DataList[2]) + | extend + RoleId = tostring(DataList[0]), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(DataList[3]), + RoleComment = tostring(DataList[4]), + RoleOwner = tostring(DataList[5]), + RoleType = tostring(DataList[6]), + RoleDatabaseName = tostring(DataList[7]), + RoleInstanceId = tostring(DataList[8]), + OwnerRoleType = tostring(DataList[9]), + RoleIsFromOrganizationUserGroup = tostring(DataList[10]) + }; + let SnowflakeRoleGrantV2_view = view () { + SnowflakeRoleGrantV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[0]), + MTime = toreal(DataList[1]), + DTime = toreal(DataList[11]) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(DataList[2]), + RoleGrantGrantedOn = tostring(DataList[3]), + RoleGrantName = tostring(DataList[4]), + RoleGrantTableCatalog = tostring(DataList[5]), + RoleGrantTableSchema = tostring(DataList[6]), + RoleGrantGrantedTo = tostring(DataList[7]), + RoleGrantGranteeName = tostring(DataList[8]), + RoleGrantGrantOption = tostring(DataList[9]), + RoleGrantGrantedBy = tostring(DataList[10]), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(DataList[12]), + RoleGrantObjectInstance = tostring(DataList[13]) + }; + let SnowflakeLoadV2_view = view () { + SnowflakeLoadV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + LTime = toreal(DataList[7]) + | extend + LoadTableId = tostring(DataList[0]), + LoadTableName = tostring(DataList[1]), + LoadSchemaId = tostring(DataList[2]), + LoadSchemaName = tostring(DataList[3]), + LoadCatalogId = tostring(DataList[4]), + LoadCatalogName = tostring(DataList[5]), + LoadFileName = tostring(DataList[6]), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(DataList[8]), + LoadRowCount = tostring(DataList[9]), + LoadRowParsed = tostring(DataList[10]), + LoadFirstErrorMessage = tostring(DataList[11]), + LoadFirstErrorLineNumber = tostring(DataList[12]), + LoadFirstErrorCharacterPosition = tostring(DataList[13]), + LoadFirstErrorColName = tostring(DataList[14]), + LoadErrorCount = tostring(DataList[15]), + LoadErrorLimit = tostring(DataList[16]) + }; + let SnowflakeTableStorageMetricsV2_view = view () { + SnowflakeTableStorageMetricsV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[13]), + TDTime = toreal(DataList[14]), + TFTime = toreal(DataList[15]), + SCTime = toreal(DataList[16]), + SDTime = toreal(DataList[17]), + CCTime = toreal(DataList[18]), + CDTime = toreal(DataList[19]) + | extend + TableStorageMetricsId = tostring(DataList[0]), + TableStorageMetricsTableName = tostring(DataList[1]), + TableStorageMetricsTableSchemaId = tostring(DataList[2]), + TableStorageMetricsTableSchema = tostring(DataList[3]), + TableStorageMetricsTableCatalogId = tostring(DataList[4]), + TableStorageMetricsTableCatalog = tostring(DataList[5]), + TableStorageMetricsCloneGroupId = tostring(DataList[6]), + TableStorageMetricsIsTransient = tostring(DataList[7]), + TableStorageMetricsActiveBytes = tostring(DataList[8]), + TableStorageMetricsTimeTravelBytes = tostring(DataList[9]), + TableStorageMetricsFailsafeBytes = tostring(DataList[10]), + TableStorageMetricsRetainedForCloneBytes = tostring(DataList[11]), + TableStorageMetricsDeleted = tostring(DataList[12]), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(DataList[20]), + TableStorageMetricsInstanceId = tostring(DataList[21]), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(DataList[22]), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(DataList[23]), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(DataList[24]), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(DataList[25]), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(DataList[26]), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(DataList[27]), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(DataList[28]), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(DataList[29]) + }; + let SnowflakeTablesV2_view = view () { + SnowflakeTablesV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + TCTime = toreal(DataList[24]), + LATime = toreal(DataList[25]), + LDTime = toreal(DataList[26]), + TDTime = toreal(DataList[28]) + | extend + TableId = tostring(DataList[0]), + TableName = tostring(DataList[1]), + TableSchemaId = tostring(DataList[2]), + TableSchema = tostring(DataList[3]), + TableCatalogId = tostring(DataList[4]), + TableCatalog = tostring(DataList[5]), + TableOwner = tostring(DataList[6]), + TableType = tostring(DataList[7]), + TableIsTransient = tostring(DataList[8]), + TableIsIceberg = tostring(DataList[9]), + TableIsDynamic = tostring(DataList[10]), + TableIsHybrid = tostring(DataList[11]), + TableClusteringKey = tostring(DataList[12]), + TableRowCount = tostring(DataList[13]), + TableBytes = tostring(DataList[14]), + TableRetentionTime = tostring(DataList[15]), + TableSelfReferencingColumnName = tostring(DataList[16]), + TableReferenceGeneration = tostring(DataList[17]), + TableUserDefinedTypeCatalog = tostring(DataList[18]), + TableUserDefinedTypeSchema = tostring(DataList[19]), + TableUserDefinedTypeName = tostring(DataList[20]), + TableIsInsertableInto = tostring(DataList[21]), + TableIsTyped = tostring(DataList[22]), + TableCommitAction = tostring(DataList[23]), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(DataList[27]), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(DataList[29]), + TableComment = tostring(DataList[30]), + TableOwnerRoleType = tostring(DataList[31]), + TableInstanceId = tostring(DataList[32]), + TableArchiveStorageCoolRowCount = tostring(DataList[33]), + TableArchiveStorageCoolBytes = tostring(DataList[34]), + TableArchiveStorageColdRowCount = tostring(DataList[35]), + TableArchiveStorageColdBytes = tostring(DataList[36]), + TableErrorLogging = tostring(DataList[37]) + }; + let SnowflakeUsersV2_view = view () { + SnowflakeUsersV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + CTime = toreal(DataList[2]), + DTime = toreal(DataList[3]), + BMTime = toreal(DataList[20]), + LSLTime = toreal(DataList[21]), + ETime = toreal(DataList[22]), + LUTime = toreal(DataList[23]), + PLSTime = toreal(DataList[25]) + | extend + UserId = tostring(DataList[0]), + UserName = tostring(DataList[1]), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(DataList[4]), + UserDisplayName = tostring(DataList[5]), + UserFirstName = tostring(DataList[6]), + UserLastName = tostring(DataList[7]), + UserEmail = tostring(DataList[8]), + UserMustChangePassword = tostring(DataList[9]), + UserHasPassword = tostring(DataList[10]), + UserComment = tostring(DataList[11]), + UserDisabled = tostring(DataList[12]), + UserSnowflakeLock = tostring(DataList[13]), + UserDefaultWarehouse = tostring(DataList[14]), + UserDefaultNamespace = tostring(DataList[15]), + UserDefaultRole = tostring(DataList[16]), + UserExtAuthnDuo = tostring(DataList[17]), + UserExtAuthnUid = tostring(DataList[18]), + UserHasMFA = tostring(DataList[19]), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(DataList[24]), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(DataList[26]), + UserDefaultSecondaryRole = tostring(DataList[27]), + UserHasPAT = tostring(DataList[28]), + UserHasWorkloadIdentity = tostring(DataList[29]), + UserType = tostring(DataList[30]), + UserDatabaseName = tostring(DataList[31]), + UserDatabaseId = tostring(DataList[32]), + UserSchemaName = tostring(DataList[33]), + UserSchemaId = tostring(DataList[34]), + UserIsFromOrganizationUser = tostring(DataList[35]), + UserProvisionedBy = tostring(DataList[36]), + UserIsEmailVerified = tostring(DataList[37]) + }; + let SnowflakeQueryV2_view = view () { + SnowflakeQueryV2_CL + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | mv-expand DataList = todynamic(Data) + | extend + QSTime = toreal(DataList[20]), + QETime = toreal(DataList[21]), + QueryTotalElapsedTime = toreal(DataList[22]), + QueryExecutionTime = toreal(DataList[40]) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(DataList[0]), + QueryText = tostring(DataList[1]), + QueryDatabaseId = tostring(DataList[2]), + QueryDatabaseName = tostring(DataList[3]), + QuerySchemaId = tostring(DataList[4]), + QuerySchemaName = tostring(DataList[5]), + QueryType = tostring(DataList[6]), + QuerySessionId = tostring(DataList[7]), + QueryAuthnEventId = tostring(DataList[8]), + QueryUserName = tostring(DataList[9]), + QueryRoleName = tostring(DataList[10]), + QueryWarehouseId = tostring(DataList[11]), + QueryWarehouseName = tostring(DataList[12]), + QueryWarehouseSize = tostring(DataList[13]), + QueryWarehouseType = tostring(DataList[14]), + QueryClusterNumber = tostring(DataList[15]), + QueryTag = tostring(DataList[16]), + QueryExecutionStatus = tostring(DataList[17]), + QueryErrorCode = tostring(DataList[18]), + QueryErrorMessage = tostring(DataList[19]), + QueryBytesScanned = tostring(DataList[23]), + QueryPercentageScannedFromCache = tostring(DataList[24]), + QueryBytesWritten = tostring(DataList[25]), + QueryBytesWrittenToResult = tostring(DataList[26]), + QueryBytesReadFromResult = tostring(DataList[27]), + QueryRowsProduced = tostring(DataList[28]), + QueryRowsInserted = tostring(DataList[29]), + QueryRowsUpdated = tostring(DataList[30]), + QueryRowsDeleted = tostring(DataList[31]), + QueryRowsUnloaded = tostring(DataList[32]), + QueryBytesDeleted = tostring(DataList[33]), + QueryPartitionsScanned = tostring(DataList[34]), + QueryPartitionsTotal = tostring(DataList[35]), + QueryBytesSpilledToLocalStorage = tostring(DataList[36]), + QueryBytesSpilledToRemoteStorage = tostring(DataList[37]), + QueryBytesSentOverTheNetwork = tostring(DataList[38]), + QueryCompilationTime = tostring(DataList[39]), + QueryQueuedProvisioningTime = tostring(DataList[41]), + QueryQueuedRepairTime = tostring(DataList[42]), + QueryQueuedOverloadTime = tostring(DataList[43]), + QueryTransactionBlockedTime = tostring(DataList[44]), + QueryOutboundDataTransferCloud = tostring(DataList[45]), + QueryOutboundDataTransferRegion = tostring(DataList[46]), + QueryOutboundDataTransferBytes = tostring(DataList[47]), + QueryInboundDataTransferCloud = tostring(DataList[48]), + QueryInboundDataTransferRegion = tostring(DataList[49]), + QueryInboundDataTransferBytes = tostring(DataList[50]), + QueryListExternalFilesTime = tostring(DataList[51]), + QueryCreditsUsedCloudServices = iff(isempty(tostring(DataList[52])), toreal(0), toreal(DataList[52])), + QueryReleaseVersion = tostring(DataList[53]), + QueryExternalFunctionTotalInvocations = tostring(DataList[54]), + QueryExternalFunctionTotalSentRows = tostring(DataList[55]), + QueryExternalFunctionTotalReceivedRows = tostring(DataList[56]), + QueryExternalFunctionTotalSentBytes = tostring(DataList[57]), + QueryExternalFunctionTotalReceivedBytes = tostring(DataList[58]), + QueryLoadPercent = tostring(DataList[59]), + QueryIsClientGeneratedStatement = tostring(DataList[60]), + QueryAccelerationBytesScanned = tostring(DataList[61]), + QueryAccelerationPartitionsScanned = tostring(DataList[62]), + QueryAccelerationUpperLimitScaleFactor = tostring(DataList[63]), + QueryTransactionId = tostring(DataList[64]), + ChildQueriesWaitTime = tostring(DataList[65]), + QueryRoleType = tostring(DataList[66]), + QueryHash = tostring(DataList[67]), + QueryHashVersion = tostring(DataList[68]), + QueryParameterizedHash = tostring(DataList[69]), + QueryParameterizedHashVersion = tostring(DataList[70]), + QuerySecondaryRoleStats = tostring(DataList[71]), + QueryRowsWrittenToResult = tostring(DataList[72]), + QueryRetryTime = tostring(DataList[73]), + QueryRetryCause = tostring(DataList[74]), + QueryFaultHandlingTime = tostring(DataList[75]), + QueryUserType = tostring(DataList[76]), + QueryUserDatabaseName = tostring(DataList[77]), + QueryUserDatabaseId = tostring(DataList[78]), + QueryUserSchemaName = tostring(DataList[79]), + QueryUserSchemaId = tostring(DataList[80]), + QueryResourceConstraint = tostring(DataList[81]), + QueryGeneration = tostring(DataList[82]), + QueryBindValues = tostring(DataList[83]), + QueryAgentType = tostring(DataList[84]) + }; + let SnowflakeLoginV3_view = view () { + union isfuzzy=true SnowflakeLoginV3_CL, (datatable(TimeGenerated:datetime, EventId:string, EventTimestamp:string, EventType:string, UserName:string, ClientIp:string, ReportedClientType:string, ReportedClientVersion:string, FirstAuthenticationFactor:string, SecondAuthenticationFactor:string, IsSuccess:string, ErrorCode:string, ErrorMessage:string, RelatedEventId:string, Connection:string, ClientPrivateLinkId:string, FirstAuthenticationFactorId:string, SecondAuthenticationFactorId:string, LoginDetails:string, AuthorizingIntegrationName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(EventTimestamp) + | extend + LoginEventId = tostring(EventId), + LoginEventTimestamp = unixtime_seconds_todatetime(LTime), + LoginEventType = tostring(EventType), + LoginUserName = tostring(UserName), + LoginClientIp = tostring(ClientIp), + LoginReportedClientType = tostring(ReportedClientType), + LoginReportedClientVersion = tostring(ReportedClientVersion), + LoginFirstAuthenticationFactor = tostring(FirstAuthenticationFactor), + LoginSecondAuthenticationFactor = tostring(SecondAuthenticationFactor), + LoginIsSuccess = tostring(IsSuccess), + LoginErrorCode = tostring(ErrorCode), + LoginErrorMessage = tostring(ErrorMessage), + LoginRelatedEventId = tostring(RelatedEventId), + LoginConnection = tostring(Connection), + LoginClientPrivateLinkId = tostring(ClientPrivateLinkId), + LoginFirstAuthenticationFactorId = tostring(FirstAuthenticationFactorId), + LoginSecondAuthenticationFactorId = tostring(SecondAuthenticationFactorId), + LoginDetails = tostring(LoginDetails), + LoginAuthorizingIntegrationName = tostring(AuthorizingIntegrationName) + | extend + TargetUsername = LoginUserName, + SrcDvcIpAddr = LoginClientIp, + User = LoginUserName, + LoginEventEndTime = LoginEventTimestamp + }; + let SnowflakeUserGrantV3_view = view () { + union isfuzzy=true SnowflakeUserGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, DeletedOn:string, Role:string, GrantedTo:string, GranteeName:string, GrantedBy:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + UserGrantCreatedOn = unixtime_seconds_todatetime(CTime), + UserGrantDeletedOn = unixtime_seconds_todatetime(DTime), + UserRole = tostring(Role), + UserGrantGrantedTo = tostring(GrantedTo), + UserGrantGranteeName = tostring(GranteeName), + UserGrantGrantedBy = tostring(GrantedBy) + }; + let SnowflakeMaterializedViewV3_view = view () { + union isfuzzy=true SnowflakeMaterializedViewV3_CL, (datatable(TimeGenerated:datetime, StartTime:string, EndTime:string, CreditsUsed:string, TableId:string, TableName:string, SchemaId:string, SchemaName:string, DatabaseId:string, DatabaseName:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + STime = toreal(StartTime), + ETime = toreal(EndTime) + | extend + MaterializedViewStartTime = unixtime_seconds_todatetime(STime), + MaterializedViewEndTime = unixtime_seconds_todatetime(ETime), + MaterializedViewCreditsUsed = tostring(CreditsUsed), + MaterializedViewTableId = tostring(TableId), + MaterializedViewTableName = tostring(TableName), + MaterializedViewSchemaId = tostring(SchemaId), + MaterializedViewSchemaName = tostring(SchemaName), + MaterializedViewDatabaseId = tostring(DatabaseId), + MaterializedViewDatabaseName = tostring(DatabaseName) + }; + let SnowflakeRolesV3_view = view () { + union isfuzzy=true SnowflakeRolesV3_CL, (datatable(TimeGenerated:datetime, RoleId:string, CreatedOn:string, DeletedOn:string, Name:string, Comment:string, Owner:string, RoleType:string, RoleDatabaseName:string, RoleInstanceId:string, OwnerRoleType:string, IsFromOrganizationUserGroup:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn) + | extend + RoleId = tostring(RoleId), + RoleCreatedOn = unixtime_seconds_todatetime(CTime), + RoleDeletedOn = unixtime_seconds_todatetime(DTime), + RoleName = tostring(Name), + RoleComment = tostring(Comment), + RoleOwner = tostring(Owner), + RoleType = tostring(RoleType), + RoleDatabaseName = tostring(RoleDatabaseName), + RoleInstanceId = tostring(RoleInstanceId), + OwnerRoleType = tostring(OwnerRoleType), + RoleIsFromOrganizationUserGroup = tostring(IsFromOrganizationUserGroup) + }; + let SnowflakeRoleGrantV3_view = view () { + union isfuzzy=true SnowflakeRoleGrantV3_CL, (datatable(TimeGenerated:datetime, CreatedOn:string, ModifiedOn:string, Privilege:string, GrantedOn:string, Name:string, TableCatalog:string, TableSchema:string, GrantedTo:string, GranteeName:string, GrantOption:string, GrantedBy:string, DeletedOn:string, GrantedByRoleType:string, ObjectInstance:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + MTime = toreal(ModifiedOn), + DTime = toreal(DeletedOn) + | extend + RoleGrantCreatedOn = unixtime_seconds_todatetime(CTime), + RoleGrantModifiedOn = unixtime_seconds_todatetime(MTime), + RoleGrantPrivilege = tostring(Privilege), + RoleGrantGrantedOn = tostring(GrantedOn), + RoleGrantName = tostring(Name), + RoleGrantTableCatalog = tostring(TableCatalog), + RoleGrantTableSchema = tostring(TableSchema), + RoleGrantGrantedTo = tostring(GrantedTo), + RoleGrantGranteeName = tostring(GranteeName), + RoleGrantGrantOption = tostring(GrantOption), + RoleGrantGrantedBy = tostring(GrantedBy), + RoleGrantDeletedOn = unixtime_seconds_todatetime(DTime), + RoleGrantGrantedByRoleType = tostring(GrantedByRoleType), + RoleGrantObjectInstance = tostring(ObjectInstance) + }; + let SnowflakeLoadV3_view = view () { + union isfuzzy=true SnowflakeLoadV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, SchemaId:string, SchemaName:string, CatalogId:string, CatalogName:string, FileName:string, LastLoadTime:string, Status:string, RowCount:string, RowParsed:string, FirstErrorMessage:string, FirstErrorLineNumber:string, FirstErrorCharacterPosition:string, FirstErrorColName:string, ErrorCount:string, ErrorLimit:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + LTime = toreal(LastLoadTime) + | extend + LoadTableId = tostring(TableId), + LoadTableName = tostring(TableName), + LoadSchemaId = tostring(SchemaId), + LoadSchemaName = tostring(SchemaName), + LoadCatalogId = tostring(CatalogId), + LoadCatalogName = tostring(CatalogName), + LoadFileName = tostring(FileName), + LoadLastLoadTime = unixtime_seconds_todatetime(LTime), + LoadStatus = tostring(Status), + LoadRowCount = tostring(RowCount), + LoadRowParsed = tostring(RowParsed), + LoadFirstErrorMessage = tostring(FirstErrorMessage), + LoadFirstErrorLineNumber = tostring(FirstErrorLineNumber), + LoadFirstErrorCharacterPosition = tostring(FirstErrorCharacterPosition), + LoadFirstErrorColName = tostring(FirstErrorColName), + LoadErrorCount = tostring(ErrorCount), + LoadErrorLimit = tostring(ErrorLimit) + }; + let SnowflakeTableStorageMetricsV3_view = view () { + union isfuzzy=true SnowflakeTableStorageMetricsV3_CL, (datatable(TimeGenerated:datetime, Id:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, CloneGroupId:string, IsTransient:string, ActiveBytes:string, TimeTravelBytes:string, FailsafeBytes:string, RetainedForCloneBytes:string, Deleted:string, TableCreated:string, TableDropped:string, TableEnteredFailsafe:string, SchemaCreated:string, SchemaDropped:string, CatalogCreated:string, CatalogDropped:string, Comment:string, InstanceId:string, ArchiveStorageCoolActiveBytes:string, ArchiveStorageColdActiveBytes:string, ArchiveStorageCoolTimeTravelBytes:string, ArchiveStorageColdTimeTravelBytes:string, ArchiveStorageCoolFailsafeBytes:string, ArchiveStorageColdFailsafeBytes:string, ArchiveStorageCoolEarlyDeletionPenaltyBytes:string, ArchiveStorageColdEarlyDeletionPenaltyBytes:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(TableCreated), + TDTime = toreal(TableDropped), + TFTime = toreal(TableEnteredFailsafe), + SCTime = toreal(SchemaCreated), + SDTime = toreal(SchemaDropped), + CCTime = toreal(CatalogCreated), + CDTime = toreal(CatalogDropped) + | extend + TableStorageMetricsId = tostring(Id), + TableStorageMetricsTableName = tostring(TableName), + TableStorageMetricsTableSchemaId = tostring(TableSchemaId), + TableStorageMetricsTableSchema = tostring(TableSchema), + TableStorageMetricsTableCatalogId = tostring(TableCatalogId), + TableStorageMetricsTableCatalog = tostring(TableCatalog), + TableStorageMetricsCloneGroupId = tostring(CloneGroupId), + TableStorageMetricsIsTransient = tostring(IsTransient), + TableStorageMetricsActiveBytes = tostring(ActiveBytes), + TableStorageMetricsTimeTravelBytes = tostring(TimeTravelBytes), + TableStorageMetricsFailsafeBytes = tostring(FailsafeBytes), + TableStorageMetricsRetainedForCloneBytes = tostring(RetainedForCloneBytes), + TableStorageMetricsDeleted = tostring(Deleted), + TableStorageMetricsTableCreated = unixtime_seconds_todatetime(TCTime), + TableStorageMetricsTableDropped = unixtime_seconds_todatetime(TDTime), + TableStorageMetricsTableEnteredFailsafe = unixtime_seconds_todatetime(TFTime), + TableStorageMetricsSchemaCreated = unixtime_seconds_todatetime(SCTime), + TableStorageMetricsSchemaDropped = unixtime_seconds_todatetime(SDTime), + TableStorageMetricsCatalogCreated = unixtime_seconds_todatetime(CCTime), + TableStorageMetricsCatalogDropped = unixtime_seconds_todatetime(CDTime), + TableStorageMetricsComment = tostring(Comment), + TableStorageMetricsInstanceId = tostring(InstanceId), + TableStorageMetricsArchiveStorageCoolActiveBytes = tostring(ArchiveStorageCoolActiveBytes), + TableStorageMetricsArchiveStorageColdActiveBytes = tostring(ArchiveStorageColdActiveBytes), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = tostring(ArchiveStorageCoolTimeTravelBytes), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = tostring(ArchiveStorageColdTimeTravelBytes), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = tostring(ArchiveStorageCoolFailsafeBytes), + TableStorageMetricsArchiveStorageColdFailsafeBytes = tostring(ArchiveStorageColdFailsafeBytes), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = tostring(ArchiveStorageCoolEarlyDeletionPenaltyBytes), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = tostring(ArchiveStorageColdEarlyDeletionPenaltyBytes) + | project-away TableCreated, TableDropped, TableEnteredFailsafe, SchemaCreated, SchemaDropped, CatalogCreated, CatalogDropped + }; + let SnowflakeTablesV3_view = view () { + union isfuzzy=true SnowflakeTablesV3_CL, (datatable(TimeGenerated:datetime, TableId:string, TableName:string, TableSchemaId:string, TableSchema:string, TableCatalogId:string, TableCatalog:string, TableOwner:string, TableType:string, IsTransient:string, IsIceberg:string, IsDynamic:string, IsHybrid:string, ClusteringKey:string, RowCount:string, Bytes:string, RetentionTime:string, SelfReferencingColumnName:string, ReferenceGeneration:string, UserDefinedTypeCatalog:string, UserDefinedTypeSchema:string, UserDefinedTypeName:string, IsInsertableInto:string, IsTyped:string, CommitAction:string, Created:string, LastAltered:string, LastDdl:string, LastDdlBy:string, Deleted:string, AutoClusteringOn:string, Comment:string, OwnerRoleType:string, InstanceId:string, ArchiveStorageCoolRowCount:string, ArchiveStorageCoolBytes:string, ArchiveStorageColdRowCount:string, ArchiveStorageColdBytes:string, ErrorLogging:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + TCTime = toreal(Created), + LATime = toreal(LastAltered), + LDTime = toreal(LastDdl), + TDTime = toreal(Deleted) + | extend + TableId = tostring(TableId), + TableName = tostring(TableName), + TableSchemaId = tostring(TableSchemaId), + TableSchema = tostring(TableSchema), + TableCatalogId = tostring(TableCatalogId), + TableCatalog = tostring(TableCatalog), + TableOwner = tostring(TableOwner), + TableType = tostring(TableType), + TableIsTransient = tostring(IsTransient), + TableIsIceberg = tostring(IsIceberg), + TableIsDynamic = tostring(IsDynamic), + TableIsHybrid = tostring(IsHybrid), + TableClusteringKey = tostring(ClusteringKey), + TableRowCount = tostring(RowCount), + TableBytes = tostring(Bytes), + TableRetentionTime = tostring(RetentionTime), + TableSelfReferencingColumnName = tostring(SelfReferencingColumnName), + TableReferenceGeneration = tostring(ReferenceGeneration), + TableUserDefinedTypeCatalog = tostring(UserDefinedTypeCatalog), + TableUserDefinedTypeSchema = tostring(UserDefinedTypeSchema), + TableUserDefinedTypeName = tostring(UserDefinedTypeName), + TableIsInsertableInto = tostring(IsInsertableInto), + TableIsTyped = tostring(IsTyped), + TableCommitAction = tostring(CommitAction), + TableCreated = unixtime_seconds_todatetime(TCTime), + TableLastAltered = unixtime_seconds_todatetime(LATime), + TableLastDDL = unixtime_seconds_todatetime(LDTime), + TableLastDDLBy = tostring(LastDdlBy), + TableDeleted = unixtime_seconds_todatetime(TDTime), + TableAutoClusteringOn = tostring(AutoClusteringOn), + TableComment = tostring(Comment), + TableOwnerRoleType = tostring(OwnerRoleType), + TableInstanceId = tostring(InstanceId), + TableArchiveStorageCoolRowCount = tostring(ArchiveStorageCoolRowCount), + TableArchiveStorageCoolBytes = tostring(ArchiveStorageCoolBytes), + TableArchiveStorageColdRowCount = tostring(ArchiveStorageColdRowCount), + TableArchiveStorageColdBytes = tostring(ArchiveStorageColdBytes), + TableErrorLogging = tostring(ErrorLogging) + }; + let SnowflakeUsersV3_view = view () { + union isfuzzy=true SnowflakeUsersV3_CL, (datatable(TimeGenerated:datetime, UserId:string, Name:string, CreatedOn:string, DeletedOn:string, LoginName:string, DisplayName:string, FirstName:string, LastName:string, Email:string, MustChangePassword:string, HasPassword:string, Comment:string, Disabled:string, SnowflakeLock:string, DefaultWarehouse:string, DefaultNamespace:string, DefaultRole:string, ExtAuthnDuo:string, ExtAuthnUid:string, HasMfa:string, BypassMfaUntil:string, LastSuccessLogin:string, ExpiresAt:string, LockedUntilTime:string, HasRsaPublicKey:string, PasswordLastSetTime:string, Owner:string, DefaultSecondaryRole:string, HasPat:string, HasWorkloadIdentity:string, UserType:string, DatabaseName:string, DatabaseId:string, SchemaName:string, SchemaId:string, IsFromOrganizationUser:string, ProvisionedBy:string, IsEmailVerified:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + CTime = toreal(CreatedOn), + DTime = toreal(DeletedOn), + BMTime = toreal(BypassMfaUntil), + LSLTime = toreal(LastSuccessLogin), + ETime = toreal(ExpiresAt), + LUTime = toreal(LockedUntilTime), + PLSTime = toreal(PasswordLastSetTime) + | extend + UserId = tostring(UserId), + UserName = tostring(Name), + UserCreatedOn = unixtime_seconds_todatetime(CTime), + UserDeletedOn = unixtime_seconds_todatetime(DTime), + UserLoginName = tostring(LoginName), + UserDisplayName = tostring(DisplayName), + UserFirstName = tostring(FirstName), + UserLastName = tostring(LastName), + UserEmail = tostring(Email), + UserMustChangePassword = tostring(MustChangePassword), + UserHasPassword = tostring(HasPassword), + UserComment = tostring(Comment), + UserDisabled = tostring(Disabled), + UserSnowflakeLock = tostring(SnowflakeLock), + UserDefaultWarehouse = tostring(DefaultWarehouse), + UserDefaultNamespace = tostring(DefaultNamespace), + UserDefaultRole = tostring(DefaultRole), + UserExtAuthnDuo = tostring(ExtAuthnDuo), + UserExtAuthnUid = tostring(ExtAuthnUid), + UserHasMFA = tostring(HasMfa), + UserBypassMFAUntil = unixtime_seconds_todatetime(BMTime), + UserLastSuccessLogin = unixtime_seconds_todatetime(LSLTime), + UserExpiresAt = unixtime_seconds_todatetime(ETime), + UserLockedUntilTime = unixtime_seconds_todatetime(LUTime), + UserHasRSAPublicKey = tostring(HasRsaPublicKey), + UserPasswordLastSetTime = unixtime_seconds_todatetime(PLSTime), + UserOwner = tostring(Owner), + UserDefaultSecondaryRole = tostring(DefaultSecondaryRole), + UserHasPAT = tostring(HasPat), + UserHasWorkloadIdentity = tostring(HasWorkloadIdentity), + UserType = tostring(UserType), + UserDatabaseName = tostring(DatabaseName), + UserDatabaseId = tostring(DatabaseId), + UserSchemaName = tostring(SchemaName), + UserSchemaId = tostring(SchemaId), + UserIsFromOrganizationUser = tostring(IsFromOrganizationUser), + UserProvisionedBy = tostring(ProvisionedBy), + UserIsEmailVerified = tostring(IsEmailVerified) + }; + let SnowflakeQueryV3_view = view () { + union isfuzzy=true SnowflakeQueryV3_CL, (datatable(TimeGenerated:datetime, QueryId:string, QueryText:string, DatabaseId:string, DatabaseName:string, SchemaId:string, SchemaName:string, QueryType:string, SessionId:string, AuthnEventId:string, UserName:string, RoleName:string, WarehouseId:string, WarehouseName:string, WarehouseSize:string, WarehouseType:string, ClusterNumber:string, QueryTag:string, ExecutionStatus:string, ErrorCode:string, ErrorMessage:string, StartTime:string, EndTime:string, TotalElapsedTime:string, BytesScanned:string, PercentageScannedFromCache:string, BytesWritten:string, BytesWrittenToResult:string, BytesReadFromResult:string, RowsProduced:string, RowsInserted:string, RowsUpdated:string, RowsDeleted:string, RowsUnloaded:string, BytesDeleted:string, PartitionsScanned:string, PartitionsTotal:string, BytesSpilledToLocalStorage:string, BytesSpilledToRemoteStorage:string, BytesSentOverTheNetwork:string, CompilationTime:string, ExecutionTime:string, QueuedProvisioningTime:string, QueuedRepairTime:string, QueuedOverloadTime:string, TransactionBlockedTime:string, OutboundDataTransferCloud:string, OutboundDataTransferRegion:string, OutboundDataTransferBytes:string, InboundDataTransferCloud:string, InboundDataTransferRegion:string, InboundDataTransferBytes:string, ListExternalFilesTime:string, CreditsUsedCloudServices:string, ReleaseVersion:string, ExternalFunctionTotalInvocations:string, ExternalFunctionTotalSentRows:string, ExternalFunctionTotalReceivedRows:string, ExternalFunctionTotalSentBytes:string, ExternalFunctionTotalReceivedBytes:string, QueryLoadPercent:string, IsClientGeneratedStatement:string, QueryAccelerationBytesScanned:string, QueryAccelerationPartitionsScanned:string, QueryAccelerationUpperLimitScaleFactor:string, TransactionId:string, ChildQueriesWaitTime:string, RoleType:string, QueryHash:string, QueryHashVersion:string, QueryParameterizedHash:string, QueryParameterizedHashVersion:string, SecondaryRoleStats:string, RowsWrittenToResult:string, QueryRetryTime:string, QueryRetryCause:string, FaultHandlingTime:string, UserType:string, UserDatabaseName:string, UserDatabaseId:string, UserSchemaName:string, UserSchemaId:string, ResourceConstraint:string, Generation:string, BindValues:string, AgentType:string, SnowflakeAccountIdentifier:string)[]) + | extend EventVendor = 'Snowflake' + | extend EventProduct = 'Snowflake' + | extend + QSTime = toreal(StartTime), + QETime = toreal(EndTime), + QueryTotalElapsedTime = toreal(TotalElapsedTime), + QueryExecutionTime = toreal(ExecutionTime) + | extend + QueryStartTime = unixtime_seconds_todatetime(QSTime), + QueryEndTime = unixtime_seconds_todatetime(QETime) + | extend + QueryId = tostring(QueryId), + QueryText = tostring(QueryText), + QueryDatabaseId = tostring(DatabaseId), + QueryDatabaseName = tostring(DatabaseName), + QuerySchemaId = tostring(SchemaId), + QuerySchemaName = tostring(SchemaName), + QueryType = tostring(QueryType), + QuerySessionId = tostring(SessionId), + QueryAuthnEventId = tostring(AuthnEventId), + QueryUserName = tostring(UserName), + QueryRoleName = tostring(RoleName), + QueryWarehouseId = tostring(WarehouseId), + QueryWarehouseName = tostring(WarehouseName), + QueryWarehouseSize = tostring(WarehouseSize), + QueryWarehouseType = tostring(WarehouseType), + QueryClusterNumber = tostring(ClusterNumber), + QueryTag = tostring(QueryTag), + QueryExecutionStatus = tostring(ExecutionStatus), + QueryErrorCode = tostring(ErrorCode), + QueryErrorMessage = tostring(ErrorMessage), + QueryBytesScanned = tostring(BytesScanned), + QueryPercentageScannedFromCache = tostring(PercentageScannedFromCache), + QueryBytesWritten = tostring(BytesWritten), + QueryBytesWrittenToResult = tostring(BytesWrittenToResult), + QueryBytesReadFromResult = tostring(BytesReadFromResult), + QueryRowsProduced = tostring(RowsProduced), + QueryRowsInserted = tostring(RowsInserted), + QueryRowsUpdated = tostring(RowsUpdated), + QueryRowsDeleted = tostring(RowsDeleted), + QueryRowsUnloaded = tostring(RowsUnloaded), + QueryBytesDeleted = tostring(BytesDeleted), + QueryPartitionsScanned = tostring(PartitionsScanned), + QueryPartitionsTotal = tostring(PartitionsTotal), + QueryBytesSpilledToLocalStorage = tostring(BytesSpilledToLocalStorage), + QueryBytesSpilledToRemoteStorage = tostring(BytesSpilledToRemoteStorage), + QueryBytesSentOverTheNetwork = tostring(BytesSentOverTheNetwork), + QueryCompilationTime = tostring(CompilationTime), + QueryQueuedProvisioningTime = tostring(QueuedProvisioningTime), + QueryQueuedRepairTime = tostring(QueuedRepairTime), + QueryQueuedOverloadTime = tostring(QueuedOverloadTime), + QueryTransactionBlockedTime = tostring(TransactionBlockedTime), + QueryOutboundDataTransferCloud = tostring(OutboundDataTransferCloud), + QueryOutboundDataTransferRegion = tostring(OutboundDataTransferRegion), + QueryOutboundDataTransferBytes = tostring(OutboundDataTransferBytes), + QueryInboundDataTransferCloud = tostring(InboundDataTransferCloud), + QueryInboundDataTransferRegion = tostring(InboundDataTransferRegion), + QueryInboundDataTransferBytes = tostring(InboundDataTransferBytes), + QueryListExternalFilesTime = tostring(ListExternalFilesTime), + QueryCreditsUsedCloudServices = iff(isempty(tostring(CreditsUsedCloudServices)), toreal(0), toreal(CreditsUsedCloudServices)), + QueryReleaseVersion = tostring(ReleaseVersion), + QueryExternalFunctionTotalInvocations = tostring(ExternalFunctionTotalInvocations), + QueryExternalFunctionTotalSentRows = tostring(ExternalFunctionTotalSentRows), + QueryExternalFunctionTotalReceivedRows = tostring(ExternalFunctionTotalReceivedRows), + QueryExternalFunctionTotalSentBytes = tostring(ExternalFunctionTotalSentBytes), + QueryExternalFunctionTotalReceivedBytes = tostring(ExternalFunctionTotalReceivedBytes), + QueryLoadPercent = tostring(QueryLoadPercent), + QueryIsClientGeneratedStatement = tostring(IsClientGeneratedStatement), + QueryAccelerationBytesScanned = tostring(QueryAccelerationBytesScanned), + QueryAccelerationPartitionsScanned = tostring(QueryAccelerationPartitionsScanned), + QueryAccelerationUpperLimitScaleFactor = tostring(QueryAccelerationUpperLimitScaleFactor), + QueryTransactionId = tostring(TransactionId), + ChildQueriesWaitTime = tostring(ChildQueriesWaitTime), + QueryRoleType = tostring(RoleType), + QueryHash = tostring(QueryHash), + QueryHashVersion = tostring(QueryHashVersion), + QueryParameterizedHash = tostring(QueryParameterizedHash), + QueryParameterizedHashVersion = tostring(QueryParameterizedHashVersion), + QuerySecondaryRoleStats = tostring(SecondaryRoleStats), + QueryRowsWrittenToResult = tostring(RowsWrittenToResult), + QueryRetryTime = tostring(QueryRetryTime), + QueryRetryCause = tostring(QueryRetryCause), + QueryFaultHandlingTime = tostring(FaultHandlingTime), + QueryUserType = tostring(UserType), + QueryUserDatabaseName = tostring(UserDatabaseName), + QueryUserDatabaseId = tostring(UserDatabaseId), + QueryUserSchemaName = tostring(UserSchemaName), + QueryUserSchemaId = tostring(UserSchemaId), + QueryResourceConstraint = tostring(ResourceConstraint), + QueryGeneration = tostring(Generation), + QueryBindValues = tostring(BindValues), + QueryAgentType = tostring(AgentType) + }; + union isfuzzy=true + (Snowflake_view), + (SnowflakeLogin_view), + (SnowflakeLoginV3_view), + (SnowflakeLoginV2_view), + (SnowflakeUserGrant_view), + (SnowflakeUserGrantV3_view), + (SnowflakeUserGrantV2_view), + (SnowflakeMaterializedView_view), + (SnowflakeMaterializedViewV3_view), + (SnowflakeMaterializedViewV2_view), + (SnowflakeRoles_view), + (SnowflakeRolesV3_view), + (SnowflakeRolesV2_view), + (SnowflakeRoleGrant_view), + (SnowflakeRoleGrantV3_view), + (SnowflakeRoleGrantV2_view), + (SnowflakeLoad_view), + (SnowflakeLoadV3_view), + (SnowflakeLoadV2_view), + (SnowflakeTableStorageMetrics_view), + (SnowflakeTableStorageMetricsV3_view), + (SnowflakeTableStorageMetricsV2_view), + (SnowflakeTables_view), + (SnowflakeTablesV3_view), + (SnowflakeTablesV2_view), + (SnowflakeUsers_view), + (SnowflakeUsersV3_view), + (SnowflakeUsersV2_view), + (SnowflakeQuery_view), + (SnowflakeQueryV3_view), + (SnowflakeQueryV2_view) + | extend + LoginEventType = column_ifexists('LoginEventType', ''), + TargetUsername = column_ifexists('TargetUsername', ''), + SrcDvcIpAddr = column_ifexists('SrcDvcIpAddr', ''), + User = column_ifexists('User', ''), + LoginEventEndTime = todatetime(column_ifexists('LoginEventEndTime', '')), + LoginEventId = column_ifexists('LoginEventId', ''), + LoginReportedClientType = column_ifexists('LoginReportedClientType', ''), + LoginReportedClientVersion = column_ifexists('LoginReportedClientVersion', ''), + LoginFirstAuthenticationFactor = column_ifexists('LoginFirstAuthenticationFactor', ''), + LoginSecondAuthenticationFactor = column_ifexists('LoginSecondAuthenticationFactor', ''), + LoginIsSuccess = column_ifexists('LoginIsSuccess', ''), + LoginErrorCode = column_ifexists('LoginErrorCode', ''), + LoginErrorMessage = column_ifexists('LoginErrorMessage', ''), + LoginRelatedEventId = column_ifexists('LoginRelatedEventId', ''), + LoginConnection = column_ifexists('LoginConnection', ''), + LoginClientPrivateLinkId = column_ifexists('LoginClientPrivateLinkId', ''), + LoginUserName = column_ifexists('LoginUserName', ''), + LoginClientIp = column_ifexists('LoginClientIp', ''), + LoginEventTimestamp = todatetime(column_ifexists('LoginEventTimestamp', '')), + LoginFirstAuthenticationFactorId = column_ifexists('LoginFirstAuthenticationFactorId', ''), + LoginSecondAuthenticationFactorId = column_ifexists('LoginSecondAuthenticationFactorId', ''), + LoginDetails = column_ifexists('LoginDetails', ''), + LoginAuthorizingIntegrationName = column_ifexists('LoginAuthorizingIntegrationName', ''), + UserGrantCreatedOn = todatetime(column_ifexists('UserGrantCreatedOn', '')), + UserGrantDeletedOn = todatetime(column_ifexists('UserGrantDeletedOn', '')), + UserRole = column_ifexists('UserRole', ''), + UserGrantGrantedTo = column_ifexists('UserGrantGrantedTo', ''), + UserGrantGranteeName = column_ifexists('UserGrantGranteeName', ''), + UserGrantGrantedBy = column_ifexists('UserGrantGrantedBy', ''), + MaterializedViewStartTime = todatetime(column_ifexists('MaterializedViewStartTime', '')), + MaterializedViewEndTime = todatetime(column_ifexists('MaterializedViewEndTime', '')), + MaterializedViewCreditsUsed = column_ifexists('MaterializedViewCreditsUsed', ''), + MaterializedViewTableId = column_ifexists('MaterializedViewTableId', ''), + MaterializedViewTableName = column_ifexists('MaterializedViewTableName', ''), + MaterializedViewSchemaId = column_ifexists('MaterializedViewSchemaId', ''), + MaterializedViewSchemaName = column_ifexists('MaterializedViewSchemaName', ''), + MaterializedViewDatabaseId = column_ifexists('MaterializedViewDatabaseId', ''), + MaterializedViewDatabaseName = column_ifexists('MaterializedViewDatabaseName', ''), + RoleId = column_ifexists('RoleId', ''), + RoleCreatedOn = todatetime(column_ifexists('RoleCreatedOn', '')), + RoleDeletedOn = todatetime(column_ifexists('RoleDeletedOn', '')), + RoleName = column_ifexists('RoleName', ''), + RoleComment = column_ifexists('RoleComment', ''), + RoleOwner = column_ifexists('RoleOwner', ''), + RoleType = column_ifexists('RoleType', ''), + RoleDatabaseName = column_ifexists('RoleDatabaseName', ''), + RoleInstanceId = column_ifexists('RoleInstanceId', ''), + OwnerRoleType = column_ifexists('OwnerRoleType', ''), + RoleIsFromOrganizationUserGroup = column_ifexists('RoleIsFromOrganizationUserGroup', ''), + RoleGrantCreatedOn = todatetime(column_ifexists('RoleGrantCreatedOn', '')), + RoleGrantModifiedOn = todatetime(column_ifexists('RoleGrantModifiedOn', '')), + RoleGrantPrivilege = column_ifexists('RoleGrantPrivilege', ''), + RoleGrantGrantedOn = column_ifexists('RoleGrantGrantedOn', ''), + RoleGrantName = column_ifexists('RoleGrantName', ''), + RoleGrantTableCatalog = column_ifexists('RoleGrantTableCatalog', ''), + RoleGrantTableSchema = column_ifexists('RoleGrantTableSchema', ''), + RoleGrantGrantedTo = column_ifexists('RoleGrantGrantedTo', ''), + RoleGrantGranteeName = column_ifexists('RoleGrantGranteeName', ''), + RoleGrantGrantOption = column_ifexists('RoleGrantGrantOption', ''), + RoleGrantGrantedBy = column_ifexists('RoleGrantGrantedBy', ''), + RoleGrantDeletedOn = todatetime(column_ifexists('RoleGrantDeletedOn', '')), + RoleGrantGrantedByRoleType = column_ifexists('RoleGrantGrantedByRoleType', ''), + RoleGrantObjectInstance = column_ifexists('RoleGrantObjectInstance', ''), + LoadTableId = column_ifexists('LoadTableId', ''), + LoadTableName = column_ifexists('LoadTableName', ''), + LoadSchemaId = column_ifexists('LoadSchemaId', ''), + LoadSchemaName = column_ifexists('LoadSchemaName', ''), + LoadCatalogId = column_ifexists('LoadCatalogId', ''), + LoadCatalogName = column_ifexists('LoadCatalogName', ''), + LoadFileName = column_ifexists('LoadFileName', ''), + LastLoadTime = column_ifexists('LastLoadTime', ''), + LoadLastLoadTime = todatetime(column_ifexists('LoadLastLoadTime', '')), + LoadStatus = column_ifexists('LoadStatus', ''), + LoadRowCount = column_ifexists('LoadRowCount', ''), + LoadRowParsed = column_ifexists('LoadRowParsed', ''), + LoadFirstErrorMessage = column_ifexists('LoadFirstErrorMessage', ''), + LoadFirstErrorLineNumber = column_ifexists('LoadFirstErrorLineNumber', ''), + LoadFirstErrorCharacterPosition = column_ifexists('LoadFirstErrorCharacterPosition', ''), + LoadFirstErrorColName = column_ifexists('LoadFirstErrorColName', ''), + LoadErrorCount = column_ifexists('LoadErrorCount', ''), + LoadErrorLimit = column_ifexists('LoadErrorLimit', ''), + TableStorageMetricsId = column_ifexists('TableStorageMetricsId', ''), + TableStorageMetricsTableName = column_ifexists('TableStorageMetricsTableName', ''), + TableStorageMetricsTableSchemaId = column_ifexists('TableStorageMetricsTableSchemaId', ''), + TableStorageMetricsTableSchema = column_ifexists('TableStorageMetricsTableSchema', ''), + TableStorageMetricsTableCatalogId = column_ifexists('TableStorageMetricsTableCatalogId', ''), + TableStorageMetricsTableCatalog = column_ifexists('TableStorageMetricsTableCatalog', ''), + TableStorageMetricsCloneGroupId = column_ifexists('TableStorageMetricsCloneGroupId', ''), + TableStorageMetricsIsTransient = column_ifexists('TableStorageMetricsIsTransient', ''), + TableStorageMetricsActiveBytes = column_ifexists('TableStorageMetricsActiveBytes', ''), + TableStorageMetricsTimeTravelBytes = column_ifexists('TableStorageMetricsTimeTravelBytes', ''), + TableStorageMetricsFailsafeBytes = column_ifexists('TableStorageMetricsFailsafeBytes', ''), + TableStorageMetricsRetainedForCloneBytes = column_ifexists('TableStorageMetricsRetainedForCloneBytes', ''), + TableStorageMetricsDeleted = column_ifexists('TableStorageMetricsDeleted', ''), + TableStorageMetricsTableCreated = todatetime(column_ifexists('TableStorageMetricsTableCreated', '')), + TableStorageMetricsTableDropped = todatetime(column_ifexists('TableStorageMetricsTableDropped', '')), + TableStorageMetricsTableEnteredFailsafe = todatetime(column_ifexists('TableStorageMetricsTableEnteredFailsafe', '')), + TableStorageMetricsSchemaCreated = todatetime(column_ifexists('TableStorageMetricsSchemaCreated', '')), + TableStorageMetricsSchemaDropped = todatetime(column_ifexists('TableStorageMetricsSchemaDropped', '')), + TableStorageMetricsCatalogCreated = todatetime(column_ifexists('TableStorageMetricsCatalogCreated', '')), + TableStorageMetricsCatalogDropped = todatetime(column_ifexists('TableStorageMetricsCatalogDropped', '')), + TableStorageMetricsComment = column_ifexists('TableStorageMetricsComment', ''), + TableStorageMetricsInstanceId = column_ifexists('TableStorageMetricsInstanceId', ''), + TableStorageMetricsArchiveStorageCoolActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolActiveBytes', ''), + TableStorageMetricsArchiveStorageColdActiveBytes = column_ifexists('TableStorageMetricsArchiveStorageColdActiveBytes', ''), + TableStorageMetricsArchiveStorageCoolTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageColdTimeTravelBytes = column_ifexists('TableStorageMetricsArchiveStorageColdTimeTravelBytes', ''), + TableStorageMetricsArchiveStorageCoolFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolFailsafeBytes', ''), + TableStorageMetricsArchiveStorageColdFailsafeBytes = column_ifexists('TableStorageMetricsArchiveStorageColdFailsafeBytes', ''), + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes', ''), + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes = column_ifexists('TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes', ''), + TableId = column_ifexists('TableId', ''), + TableName = column_ifexists('TableName', ''), + TableSchemaId = column_ifexists('TableSchemaId', ''), + TableSchema = column_ifexists('TableSchema', ''), + TableCatalogId = column_ifexists('TableCatalogId', ''), + TableCatalog = column_ifexists('TableCatalog', ''), + TableOwner = column_ifexists('TableOwner', ''), + TableType = column_ifexists('TableType', ''), + TableIsTransient = column_ifexists('TableIsTransient', ''), + TableIsIceberg = column_ifexists('TableIsIceberg', ''), + TableIsDynamic = column_ifexists('TableIsDynamic', ''), + TableIsHybrid = column_ifexists('TableIsHybrid', ''), + TableClusteringKey = column_ifexists('TableClusteringKey', ''), + TableRowCount = column_ifexists('TableRowCount', ''), + TableBytes = column_ifexists('TableBytes', ''), + TableRetentionTime = column_ifexists('TableRetentionTime', ''), + TableSelfReferencingColumnName = column_ifexists('TableSelfReferencingColumnName', ''), + TableReferenceGeneration = column_ifexists('TableReferenceGeneration', ''), + TableUserDefinedTypeCatalog = column_ifexists('TableUserDefinedTypeCatalog', ''), + TableUserDefinedTypeSchema = column_ifexists('TableUserDefinedTypeSchema', ''), + TableUserDefinedTypeName = column_ifexists('TableUserDefinedTypeName', ''), + TableIsInsertableInto = column_ifexists('TableIsInsertableInto', ''), + TableIsTyped = column_ifexists('TableIsTyped', ''), + TableCommitAction = column_ifexists('TableCommitAction', ''), + TableCreated = todatetime(column_ifexists('TableCreated', '')), + TableLastAltered = todatetime(column_ifexists('TableLastAltered', '')), + TableLastDDL = todatetime(column_ifexists('TableLastDDL', '')), + TableLastDDLBy = column_ifexists('TableLastDDLBy', ''), + TableDeleted = todatetime(column_ifexists('TableDeleted', '')), + TableAutoClusteringOn = column_ifexists('TableAutoClusteringOn', ''), + TableComment = column_ifexists('TableComment', ''), + TableOwnerRoleType = column_ifexists('TableOwnerRoleType', ''), + TableInstanceId = column_ifexists('TableInstanceId', ''), + TableArchiveStorageCoolRowCount = column_ifexists('TableArchiveStorageCoolRowCount', ''), + TableArchiveStorageCoolBytes = column_ifexists('TableArchiveStorageCoolBytes', ''), + TableArchiveStorageColdRowCount = column_ifexists('TableArchiveStorageColdRowCount', ''), + TableArchiveStorageColdBytes = column_ifexists('TableArchiveStorageColdBytes', ''), + TableErrorLogging = column_ifexists('TableErrorLogging', ''), + UserId = column_ifexists('UserId', ''), + UserName = column_ifexists('UserName', ''), + UserCreatedOn = todatetime(column_ifexists('UserCreatedOn', '')), + UserDeletedOn = todatetime(column_ifexists('UserDeletedOn', '')), + UserLoginName = column_ifexists('UserLoginName', ''), + UserDisplayName = column_ifexists('UserDisplayName', ''), + UserFirstName = column_ifexists('UserFirstName', ''), + UserLastName = column_ifexists('UserLastName', ''), + UserEmail = column_ifexists('UserEmail', ''), + UserMustChangePassword = column_ifexists('UserMustChangePassword', ''), + UserHasPassword = column_ifexists('UserHasPassword', ''), + UserComment = column_ifexists('UserComment', ''), + UserDisabled = column_ifexists('UserDisabled', ''), + UserSnowflakeLock = column_ifexists('UserSnowflakeLock', ''), + UserDefaultWarehouse = column_ifexists('UserDefaultWarehouse', ''), + UserDefaultNamespace = column_ifexists('UserDefaultNamespace', ''), + UserDefaultRole = column_ifexists('UserDefaultRole', ''), + UserExtAuthnDuo = column_ifexists('UserExtAuthnDuo', ''), + UserExtAuthnUid = column_ifexists('UserExtAuthnUid', ''), + UserHasMFA = column_ifexists('UserHasMFA', ''), + UserBypassMFAUntil = todatetime(column_ifexists('UserBypassMFAUntil', '')), + UserLastSuccessLogin = todatetime(column_ifexists('UserLastSuccessLogin', '')), + UserExpiresAt = todatetime(column_ifexists('UserExpiresAt', '')), + UserLockedUntilTime = todatetime(column_ifexists('UserLockedUntilTime', '')), + UserHasRSAPublicKey = column_ifexists('UserHasRSAPublicKey', ''), + UserPasswordLastSetTime = todatetime(column_ifexists('UserPasswordLastSetTime', '')), + UserOwner = column_ifexists('UserOwner', ''), + UserDefaultSecondaryRole = column_ifexists('UserDefaultSecondaryRole', ''), + UserHasPAT = column_ifexists('UserHasPAT', ''), + UserHasWorkloadIdentity = column_ifexists('UserHasWorkloadIdentity', ''), + UserType = column_ifexists('UserType', ''), + UserDatabaseName = column_ifexists('UserDatabaseName', ''), + UserDatabaseId = column_ifexists('UserDatabaseId', ''), + UserSchemaName = column_ifexists('UserSchemaName', ''), + UserSchemaId = column_ifexists('UserSchemaId', ''), + UserIsFromOrganizationUser = column_ifexists('UserIsFromOrganizationUser', ''), + UserProvisionedBy = column_ifexists('UserProvisionedBy', ''), + UserIsEmailVerified = column_ifexists('UserIsEmailVerified', ''), + QueryId = column_ifexists('QueryId', ''), + QueryText = column_ifexists('QueryText', ''), + QueryDatabaseId = column_ifexists('QueryDatabaseId', ''), + QueryDatabaseName = column_ifexists('QueryDatabaseName', ''), + QuerySchemaId = column_ifexists('QuerySchemaId', ''), + QuerySchemaName = column_ifexists('QuerySchemaName', ''), + QueryType = column_ifexists('QueryType', ''), + QuerySessionId = column_ifexists('QuerySessionId', ''), + QueryAuthnEventId = column_ifexists('QueryAuthnEventId', ''), + QueryUserName = column_ifexists('QueryUserName', ''), + QueryRoleName = column_ifexists('QueryRoleName', ''), + QueryWarehouseId = column_ifexists('QueryWarehouseId', ''), + QueryWarehouseName = column_ifexists('QueryWarehouseName', ''), + QueryWarehouseSize = column_ifexists('QueryWarehouseSize', ''), + QueryWarehouseType = column_ifexists('QueryWarehouseType', ''), + QueryClusterNumber = column_ifexists('QueryClusterNumber', ''), + QueryTag = column_ifexists('QueryTag', ''), + QueryExecutionStatus = column_ifexists('QueryExecutionStatus', ''), + QueryErrorCode = column_ifexists('QueryErrorCode', ''), + QueryErrorMessage = column_ifexists('QueryErrorMessage', ''), + QueryStartTime = todatetime(column_ifexists('QueryStartTime', '')), + QueryTotalElapsedTime = column_ifexists('QueryTotalElapsedTime', ''), + QueryBytesScanned = column_ifexists('QueryBytesScanned', ''), + QueryPercentageScannedFromCache = column_ifexists('QueryPercentageScannedFromCache', ''), + QueryBytesWritten = column_ifexists('QueryBytesWritten', ''), + QueryBytesWrittenToResult = column_ifexists('QueryBytesWrittenToResult', ''), + QueryBytesReadFromResult = column_ifexists('QueryBytesReadFromResult', ''), + QueryRowsProduced = column_ifexists('QueryRowsProduced', ''), + QueryRowsInserted = column_ifexists('QueryRowsInserted', ''), + QueryRowsUpdated = column_ifexists('QueryRowsUpdated', ''), + QueryRowsDeleted = column_ifexists('QueryRowsDeleted', ''), + QueryRowsUnloaded = column_ifexists('QueryRowsUnloaded', ''), + QueryBytesDeleted = column_ifexists('QueryBytesDeleted', ''), + QueryPartitionsScanned = column_ifexists('QueryPartitionsScanned', ''), + QueryPartitionsTotal = column_ifexists('QueryPartitionsTotal', ''), + QueryBytesSpilledToLocalStorage = column_ifexists('QueryBytesSpilledToLocalStorage', ''), + QueryBytesSpilledToRemoteStorage = column_ifexists('QueryBytesSpilledToRemoteStorage', ''), + QueryBytesSentOverTheNetwork = column_ifexists('QueryBytesSentOverTheNetwork', ''), + QueryCompilationTime = column_ifexists('QueryCompilationTime', ''), + QueryExecutionTime = column_ifexists('QueryExecutionTime', ''), + QueryQueuedProvisioningTime = column_ifexists('QueryQueuedProvisioningTime', ''), + QueryQueuedRepairTime = column_ifexists('QueryQueuedRepairTime', ''), + QueryQueuedOverloadTime = column_ifexists('QueryQueuedOverloadTime', ''), + QueryTransactionBlockedTime = column_ifexists('QueryTransactionBlockedTime', ''), + QueryOutboundDataTransferCloud = column_ifexists('QueryOutboundDataTransferCloud', ''), + QueryOutboundDataTransferRegion = column_ifexists('QueryOutboundDataTransferRegion', ''), + QueryOutboundDataTransferBytes = column_ifexists('QueryOutboundDataTransferBytes', ''), + QueryInboundDataTransferCloud = column_ifexists('QueryInboundDataTransferCloud', ''), + QueryInboundDataTransferRegion = column_ifexists('QueryInboundDataTransferRegion', ''), + QueryInboundDataTransferBytes = column_ifexists('QueryInboundDataTransferBytes', ''), + QueryListExternalFilesTime = column_ifexists('QueryListExternalFilesTime', ''), + QueryCreditsUsedCloudServices = column_ifexists('QueryCreditsUsedCloudServices', ''), + QueryReleaseVersion = column_ifexists('QueryReleaseVersion', ''), + QueryExternalFunctionTotalInvocations = column_ifexists('QueryExternalFunctionTotalInvocations', ''), + QueryExternalFunctionTotalSentRows = column_ifexists('QueryExternalFunctionTotalSentRows', ''), + QueryExternalFunctionTotalReceivedRows = column_ifexists('QueryExternalFunctionTotalReceivedRows', ''), + QueryExternalFunctionTotalSentBytes = column_ifexists('QueryExternalFunctionTotalSentBytes', ''), + QueryExternalFunctionTotalReceivedBytes = column_ifexists('QueryExternalFunctionTotalReceivedBytes', ''), + QueryLoadPercent = column_ifexists('QueryLoadPercent', ''), + QueryIsClientGeneratedStatement = column_ifexists('QueryIsClientGeneratedStatement', ''), + QueryAccelerationBytesScanned = column_ifexists('QueryAccelerationBytesScanned', ''), + QueryAccelerationPartitionsScanned = column_ifexists('QueryAccelerationPartitionsScanned', ''), + QueryAccelerationUpperLimitScaleFactor = column_ifexists('QueryAccelerationUpperLimitScaleFactor', ''), + QueryTransactionId = column_ifexists('QueryTransactionId', ''), + ChildQueriesWaitTime = column_ifexists('ChildQueriesWaitTime', ''), + QueryRoleType = column_ifexists('QueryRoleType', ''), + QueryHash = column_ifexists('QueryHash', ''), + QueryHashVersion = column_ifexists('QueryHashVersion', ''), + QueryParameterizedHash = column_ifexists('QueryParameterizedHash', ''), + QueryParameterizedHashVersion = column_ifexists('QueryParameterizedHashVersion', ''), + QuerySecondaryRoleStats = column_ifexists('QuerySecondaryRoleStats', ''), + QueryRowsWrittenToResult = column_ifexists('QueryRowsWrittenToResult', ''), + QueryRetryTime = column_ifexists('QueryRetryTime', ''), + QueryRetryCause = column_ifexists('QueryRetryCause', ''), + QueryFaultHandlingTime = column_ifexists('QueryFaultHandlingTime', ''), + QueryUserType = column_ifexists('QueryUserType', ''), + QueryUserDatabaseName = column_ifexists('QueryUserDatabaseName', ''), + QueryUserDatabaseId = column_ifexists('QueryUserDatabaseId', ''), + QueryUserSchemaName = column_ifexists('QueryUserSchemaName', ''), + QueryUserSchemaId = column_ifexists('QueryUserSchemaId', ''), + QueryResourceConstraint = column_ifexists('QueryResourceConstraint', ''), + QueryGeneration = column_ifexists('QueryGeneration', ''), + QueryBindValues = column_ifexists('QueryBindValues', ''), + QueryAgentType = column_ifexists('QueryAgentType', '') + | extend DatabaseName = coalesce(QueryDatabaseName, UserDatabaseName, RoleDatabaseName, MaterializedViewDatabaseName) + | extend TableNames = coalesce(TableName, MaterializedViewTableName, LoadTableName, TableStorageMetricsTableName) + | extend EventStartTime = coalesce( + todatetime(column_ifexists('EventStartTime', todatetime(''))), + LoginEventTimestamp, + QueryStartTime, + MaterializedViewStartTime, + RoleGrantCreatedOn, + RoleCreatedOn, + LoadLastLoadTime, + TableCreated, + UserCreatedOn, + TimeGenerated) + | extend Type = column_ifexists('Type', '') + | project + EventVendor, + EventProduct, + EventStartTime, + LoginEventType, + TargetUsername, + SrcDvcIpAddr, + User, + LoginEventEndTime, + LoginEventId, + LoginReportedClientType, + LoginReportedClientVersion, + LoginFirstAuthenticationFactor, + LoginSecondAuthenticationFactor, + LoginIsSuccess, + LoginErrorCode, + LoginErrorMessage, + LoginRelatedEventId, + LoginConnection, + LoginClientPrivateLinkId, + LoginUserName, + LoginClientIp, + LoginEventTimestamp, + LoginFirstAuthenticationFactorId, + LoginSecondAuthenticationFactorId, + LoginDetails, + LoginAuthorizingIntegrationName, + UserGrantCreatedOn, + UserGrantDeletedOn, + UserRole, + UserGrantGrantedTo, + UserGrantGranteeName, + UserGrantGrantedBy, + MaterializedViewStartTime, + MaterializedViewEndTime, + MaterializedViewCreditsUsed, + MaterializedViewTableId, + MaterializedViewTableName, + MaterializedViewSchemaId, + MaterializedViewSchemaName, + MaterializedViewDatabaseId, + MaterializedViewDatabaseName, + RoleId, + RoleCreatedOn, + RoleDeletedOn, + RoleName, + RoleComment, + RoleOwner, + RoleType, + RoleDatabaseName, + RoleInstanceId, + OwnerRoleType, + RoleIsFromOrganizationUserGroup, + RoleGrantCreatedOn, + RoleGrantModifiedOn, + RoleGrantPrivilege, + RoleGrantGrantedOn, + RoleGrantName, + RoleGrantTableCatalog, + RoleGrantTableSchema, + RoleGrantGrantedTo, + RoleGrantGranteeName, + RoleGrantGrantOption, + RoleGrantGrantedBy, + RoleGrantDeletedOn, + RoleGrantGrantedByRoleType, + RoleGrantObjectInstance, + LoadTableId, + LoadTableName, + LoadSchemaId, + LoadSchemaName, + LoadCatalogId, + LoadCatalogName, + LoadFileName, + LastLoadTime, + LoadLastLoadTime, + LoadStatus, + LoadRowCount, + LoadRowParsed, + LoadFirstErrorMessage, + LoadFirstErrorLineNumber, + LoadFirstErrorCharacterPosition, + LoadFirstErrorColName, + LoadErrorCount, + LoadErrorLimit, + TableStorageMetricsId, + TableStorageMetricsTableName, + TableStorageMetricsTableSchemaId, + TableStorageMetricsTableSchema, + TableStorageMetricsTableCatalogId, + TableStorageMetricsTableCatalog, + TableStorageMetricsCloneGroupId, + TableStorageMetricsIsTransient, + TableStorageMetricsActiveBytes, + TableStorageMetricsTimeTravelBytes, + TableStorageMetricsFailsafeBytes, + TableStorageMetricsRetainedForCloneBytes, + TableStorageMetricsDeleted, + TableStorageMetricsTableCreated, + TableStorageMetricsTableDropped, + TableStorageMetricsTableEnteredFailsafe, + TableStorageMetricsSchemaCreated, + TableStorageMetricsSchemaDropped, + TableStorageMetricsCatalogCreated, + TableStorageMetricsCatalogDropped, + TableStorageMetricsComment, + TableStorageMetricsInstanceId, + TableStorageMetricsArchiveStorageCoolActiveBytes, + TableStorageMetricsArchiveStorageColdActiveBytes, + TableStorageMetricsArchiveStorageCoolTimeTravelBytes, + TableStorageMetricsArchiveStorageColdTimeTravelBytes, + TableStorageMetricsArchiveStorageCoolFailsafeBytes, + TableStorageMetricsArchiveStorageColdFailsafeBytes, + TableStorageMetricsArchiveStorageCoolEarlyDeletionPenaltyBytes, + TableStorageMetricsArchiveStorageColdEarlyDeletionPenaltyBytes, + TableId, + TableName, + TableNames, + TableSchemaId, + TableSchema, + TableCatalogId, + TableCatalog, + TableOwner, + TableType, + TableIsTransient, + TableIsIceberg, + TableIsDynamic, + TableIsHybrid, + TableClusteringKey, + TableRowCount, + TableBytes, + TableRetentionTime, + TableSelfReferencingColumnName, + TableReferenceGeneration, + TableUserDefinedTypeCatalog, + TableUserDefinedTypeSchema, + TableUserDefinedTypeName, + TableIsInsertableInto, + TableIsTyped, + TableCommitAction, + TableCreated, + TableLastAltered, + TableLastDDL, + TableLastDDLBy, + TableDeleted, + TableAutoClusteringOn, + TableComment, + TableOwnerRoleType, + TableInstanceId, + TableArchiveStorageCoolRowCount, + TableArchiveStorageCoolBytes, + TableArchiveStorageColdRowCount, + TableArchiveStorageColdBytes, + TableErrorLogging, + UserId, + UserName, + UserCreatedOn, + UserDeletedOn, + UserLoginName, + UserDisplayName, + UserFirstName, + UserLastName, + UserEmail, + UserMustChangePassword, + UserHasPassword, + UserComment, + UserDisabled, + UserSnowflakeLock, + UserDefaultWarehouse, + UserDefaultNamespace, + UserDefaultRole, + UserExtAuthnDuo, + UserExtAuthnUid, + UserHasMFA, + UserBypassMFAUntil, + UserLastSuccessLogin, + UserExpiresAt, + UserLockedUntilTime, + UserHasRSAPublicKey, + UserPasswordLastSetTime, + UserOwner, + UserDefaultSecondaryRole, + UserHasPAT, + UserHasWorkloadIdentity, + UserType, + UserDatabaseName, + UserDatabaseId, + UserSchemaName, + UserSchemaId, + UserIsFromOrganizationUser, + UserProvisionedBy, + UserIsEmailVerified, + QueryId, + QueryText, + QueryDatabaseId, + QueryDatabaseName, + QuerySchemaId, + QuerySchemaName, + QueryType, + QuerySessionId, + QueryAuthnEventId, + QueryUserName, + QueryRoleName, + QueryWarehouseId, + QueryWarehouseName, + QueryWarehouseSize, + QueryWarehouseType, + QueryClusterNumber, + QueryTag, + QueryExecutionStatus, + QueryErrorCode, + QueryErrorMessage, + QueryStartTime, + QueryTotalElapsedTime, + QueryBytesScanned, + QueryPercentageScannedFromCache, + QueryBytesWritten, + QueryBytesWrittenToResult, + QueryBytesReadFromResult, + QueryRowsProduced, + QueryRowsInserted, + QueryRowsUpdated, + QueryRowsDeleted, + QueryRowsUnloaded, + QueryBytesDeleted, + QueryPartitionsScanned, + QueryPartitionsTotal, + QueryBytesSpilledToLocalStorage, + QueryBytesSpilledToRemoteStorage, + QueryBytesSentOverTheNetwork, + QueryCompilationTime, + QueryExecutionTime, + QueryQueuedProvisioningTime, + QueryQueuedRepairTime, + QueryQueuedOverloadTime, + QueryTransactionBlockedTime, + QueryOutboundDataTransferCloud, + QueryOutboundDataTransferRegion, + QueryOutboundDataTransferBytes, + QueryInboundDataTransferCloud, + QueryInboundDataTransferRegion, + QueryInboundDataTransferBytes, + QueryListExternalFilesTime, + QueryCreditsUsedCloudServices, + QueryReleaseVersion, + QueryExternalFunctionTotalInvocations, + QueryExternalFunctionTotalSentRows, + QueryExternalFunctionTotalReceivedRows, + QueryExternalFunctionTotalSentBytes, + QueryExternalFunctionTotalReceivedBytes, + QueryLoadPercent, + QueryIsClientGeneratedStatement, + QueryAccelerationBytesScanned, + QueryAccelerationPartitionsScanned, + QueryAccelerationUpperLimitScaleFactor, + QueryTransactionId, + ChildQueriesWaitTime, + QueryRoleType, + QueryHash, + QueryHashVersion, + QueryParameterizedHash, + QueryParameterizedHashVersion, + QuerySecondaryRoleStats, + QueryRowsWrittenToResult, + QueryRetryTime, + QueryRetryCause, + QueryFaultHandlingTime, + QueryUserType, + QueryUserDatabaseName, + QueryUserDatabaseId, + QueryUserSchemaName, + QueryUserSchemaId, + QueryResourceConstraint, + QueryGeneration, + QueryBindValues, + QueryAgentType, + DatabaseName, + TimeGenerated, + Type + }; + let adm_roles = dynamic(['SECURITYADMIN', 'SYSADMIN', 'ACCOUNTADMIN']); + __xdr_inline_Snowflake + | where QueryType =~ 'GRANT' + | where QueryText startswith 'GRANT ROLE' + | extend granted_role = extract(@'GRANT ROLE\s(\S+)\sto\suser', 1, QueryText) + | where granted_role in~ (adm_roles) + | extend usr = extract(@'GRANT ROLE\s(\S+)\sto\suser(\S+)', 2, QueryText) + | extend AccountCustomEntity = usr + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Snowflake - User granted admin privileges + description: '''Detects when user asigned admin privileges.''' + severity: medium + entityMappings: + accounts: + - id: account1 + upnColumn: AccountCustomEntity + tactics: + - tactic: PrivilegeEscalation + techniques: + - technique: T1078