The IT Security team has identified that there is an ongoing credential stuffing attack on many of their organization's system.
What is the BEST way to find recent and ongoing login attempts to Snowflake?

Question

The IT Security team has identified that there is an ongoing credential stuffing attack on many of their organization's system.

What is the BEST way to find recent and ongoing login attempts to Snowflake?

Erwin Zeisseink · Accepted Answer

Query the LOGIN_HISTORY view in the ACCOUNT_USAGE schema in the SNOWFLAKE database.

Erwin Zeisseink · Answer

Call the LOGIN_HISTORY Information Schema table function.

Erwin Zeisseink · Answer

View the History tab in the Snowflake UI and set up a filter for SQL text that contains the text 'LOGIN'.

Erwin Zeisseink · Answer

View the Users section in the Account tab in the Snowflake UI and review the last login column.

List of questions