> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/software-as-a-service/snowflake.md). # Snowflake ### Introduction Snowflake is a fully managed, cloud-native data warehouse built to process structured and semi-structured data at massive scale. Its architecture separates storage from compute, enabling organisations to independently scale ingestion, analytics, machine learning, and reporting workloads without impacting performance. Monitoring Snowflake with ThreatDefence extends security visibility beyond traditional infrastructure into cloud-hosted data platforms. By integrating Snowflake audit and usage telemetry into the ThreatDefence SIEM, security teams can detect suspicious behaviour such as anomalous login patterns, repeated authentication failures, privilege escalation, unusual query activity, and sensitive data access. This document outlines how to configure Snowflake to export relevant logs and provide them to ThreatDefence for continuous monitoring and analysis. ### Step 1 – Configure Snowflake Account Access Follow the steps below to obtain the connection parameters required for ThreatDefence SIEM integration. #### 1. Create or Access Your Snowflake Account * Navigate to the Snowflake sign-up page. * Create a new account and select your preferred cloud provider (AWS, Azure, or GCP). * If an account already exists, select Sign in and log in. *** #### 2. Retrieve Account Connection Details 1. Click your profile avatar (top right corner). 2. Navigate to:\ Account → View account details 3. Open the Config File tab. *** #### 3. Select Connection Parameters Within the Config File tab, select: * Warehouse: TARGET\_WAREHOUSE * Database: SNOWFLAKE * Connection Method: Password Record the configuration details displayed. These parameters are required for ThreatDefence to establish secure log collection from your Snowflake environment. ### Step 2 – Provide Configuration Details to ThreatDefence Once the Snowflake connection parameters have been retrieved, provide the configuration details recorded at Step 1 to ThreatDefence to enable SIEM integration: * USER * PASSWORD * ACCOUNT * WAREHOUSE * DATABASE * SCHEMA --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.threatdefence.com/siem-integrations/software-as-a-service/snowflake.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.