Snowflake is a fully managed data platform that enables users to store, process, and analyze large volumes of data across their cloud environments. Recently, Datadog’s Security Research Team posted a threat hunting guide to help defenders ensure the security of their Snowflake instances. Now, we’ve released an updated integration for Snowflake that converts many of these threat hunts into proactive detections—developed by our detection engineers and tested by our internal security team—that you can deploy in your environment.
In this post, we’ll outline the out-of-the-box (OOTB) detections in Datadog Cloud SIEM, made available through the updated Snowflake integration, to help you improve security alerting around your Snowflake instance. Then, we’ll discuss how our own security team tuned these detections for our environment, to show some practical examples of how teams can modify the OOTB detections to make them as actionable as possible.
To roll out thorough Snowflake detections for our customers, the updated integration ingests the following additional data tables and makes them available in Cloud SIEM:
The availability of log data from these tables in Datadog enables Cloud SIEM to provide the following OOTB threat detections for Snowflake environments:
Use these detections to search for activity that suggest an attacker may have successfully gained access to your Snowflake environment.
Use this detection to identify activity that could indicate an attacker has gained persistent access to your Snowflake environment.
Use these detections to identify potential access of Snowflake credentials by an attacker.
Use this detection to help you identify activity that could indicate an attacker is attempting to evade established defense protocols in your environment.
Use this detection to search for attempts by a potential attacker to collect data from your Snowflake instances.
Use these methods to detect activity that could reflect an attacker exfiltrating data from your environment.
Our OOTB threat detections are intended to get security teams up and running quickly with monitoring the security of their Snowflake instances. But as you use these detection rules, or if your environment has particularly unique security needs, you may find that additional modifications to the detections help you get more value out of them. The Threat Detection Engineering Team at Datadog has adopted many of these OOTB detections and modified them to ensure they are performing well for our own environment. In this section, we’ll walk you through the ways we fine-tuned these detections for our needs. While the needs of your environment will be different, you can use similar methods to flexibly adapt Cloud SIEM’s Snowflake detections.
As our production detection engineers roll out new detections, we clone the OOTB detections so that we can modify each rule’s query, severity, and runbook according to our environment.
The team manages our rules as code by using Terraform modules. As a result, there are two approaches we take for integrating default rules into our repository:
With option 1, we’re incorporating the rule as is, without modifications to the severity, runbook, or suppression. However, importing the resource allows us to update the notification rules so that we can adjust how we’re alerted based on the severity of the associated case.
When we use option 2, we’re incorporating the rule with modifications to the name, runbook, severity, and/or suppressions. This allows us to link to the runbook the internal documentation detailing how to respond to signals, adjust the severity based on our environment, and tune the rule to avoid alerting on expected behavior. Modifying the name is a requirement of the Terraform provider, since no two rules can have the same name. (This option essentially creates a new rule, whereas option 1 imports the existing rule.)
After cloning, the team decides if it’s better to use the modified rules independently or chain them together into a signal correlation rule, which combines multiple types of detections (including those with varying severity levels) into a new, more complex rule. This type of rule can improve fidelity without losing the value of a lower-severity signal.
For example, our team has a signal correlation rule that involves the following signals:
Excessive data involving these signals can be noisy, especially when the signals are of INFO or LOW severity. However, correlating these rules together can improve the fidelity of lower-severity signals. Our correlation rule generates a HIGH-severity signal if Cloud SIEM finds two or more INFO or LOW severity signals corresponding to these rules, so we know to investigate the emerging pattern of suspicious activity that could signal an attack.
Suppressions are specific conditions in which you can tell Cloud SIEM not to generate a signal in order to improve the accuracy and relevance of your signals.
For example, relying on the knowledge that all human users can access Snowflake only via SSO, our team was able to use the following query to generate a list of all service accounts in our Snowflake instance:
select
*
from snowflake.account_usage.users
where deleted_on is null
and (has_password = true or has_rsa_public_key = true);
Using this list, we created a suppression rule that we can attach to detection rules that don’t apply to service accounts, allowing us to filter out noisy signals.
Additionally, we created a suppression rule for IP addresses or users that have successfully logged in in the past, in order to cut down the noise in the “Snowflake brute-force attack” detection by decreasing the likelihood of false positives.
You can also increase the value you’re getting from the new Snowflake detections in Cloud SIEM by using Datadog Workflow Automation, which allows you to orchestrate and automate your end-to-end processes. Creating a workflow in Datadog allows you to set specific actions to automatically occur in response to a particular signal or signals.
In our case, we created a workflow that:
If you’re interested in trying some of our OOTB Snowflake detections, here’s how to get started:
If you’re new to Datadog, sign up for a free 14-day trial.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。