, 'Snowflake Authentication Failure ' AS title snowflake_authorization_error_alert_query TO ROLE snowalert ĬREATE OR REPLACE VIEW rules.snowflake_authentication_failure_alert_query COPY GRANTS AS , 'snowflake_authorization_error_alert_query ' AS query_nameįrom snowflake. , 'Received an authorization error ' AS action , 'User ' || USER_NAME || ' received ' || ERROR_MESSAGE AS description , 'Snowflake Access Control Error ' AS title snowflake_admin_role_grant_monitor_alert_query TO ROLE snowalert ĬREATE OR REPLACE VIEW rules.snowflake_authorization_error_alert_query COPY GRANTS AS account_usage.query_historyĪND (object ILIKE '%securityadmin% ' OR object ILIKE '%accountadmin% ') , 'snowflake_admin_role_grant_monitor_alert_query ' AS query_nameįROM snowflake. , 'A new grant was added ' || LOWER(REGEXP_SUBSTR(query_text, ' \s(to \s+ \s+) ? ', 1, 1, 'ie ')) || ' by user ' || user_name || ' using role ' || role_name AS description , 'Snowflake - Admin role granted ' AS alerttype

, 'Snowflake ADMIN Role Granted ' AS title , ARRAY_CONSTRUCT( 'snowflake ') AS sources OBJECT_CONSTRUCT( 'cloud ', 'Snowflake ', 'account ', current_account()) AS environment CREATE OR REPLACE VIEW rules.snowflake_admin_role_grant_monitor_alert_query COPY GRANTS AS

Ilike snowflake