> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/software-as-a-service/snowflake.md). # Snowflake ### Introduction Snowflake is a fully managed, cloud-native data warehouse built to process structured and semi-structured data at massive scale. Its architecture separates storage from compute, enabling organisations to independently scale ingestion, analytics, machine learning, and reporting workloads without impacting performance. Monitoring Snowflake with ThreatDefence extends security visibility beyond traditional infrastructure into cloud-hosted data platforms. By integrating Snowflake audit and usage telemetry into the ThreatDefence SIEM, security teams can detect suspicious behaviour such as anomalous login patterns, repeated authentication failures, privilege escalation, unusual query activity, and sensitive data access. This document outlines how to configure Snowflake to export relevant logs and provide them to ThreatDefence for continuous monitoring and analysis. ### Step 1 – Configure Snowflake Account Access Follow the steps below to obtain the connection parameters required for ThreatDefence SIEM integration. #### 1. Create or Access Your Snowflake Account * Navigate to the Snowflake sign-up page. * Create a new account and select your preferred cloud provider (AWS, Azure, or GCP). * If an account already exists, select Sign in and log in. *** #### 2. Retrieve Account Connection Details 1. Click your profile avatar (top right corner). 2. Navigate to:\ Account → View account details 3. Open the Config File tab. *** #### 3. Select Connection Parameters Within the Config File tab, select: * Warehouse: TARGET\_WAREHOUSE * Database: SNOWFLAKE * Connection Method: Password Record the configuration details displayed. These parameters are required for ThreatDefence to establish secure log collection from your Snowflake environment. ### Step 2 – Provide Configuration Details to ThreatDefence Once the Snowflake connection parameters have been retrieved, provide the configuration details recorded at Step 1 to ThreatDefence to enable SIEM integration: * USER * PASSWORD * ACCOUNT * WAREHOUSE * DATABASE * SCHEMA --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.threatdefence.com/siem-integrations/software-as-a-service/snowflake.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.