Snowflake External Data Share

AnalysisType: rule
Filename: snowflake_stream_external_shares.py
RuleID: Snowflake.Stream.ExternalShares
DisplayName: Snowflake External Data Share
Enabled: true
LogTypes:
  - Snowflake.DataTransferHistory
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0010:T1537
Description: Detect when an external share has been initiated from one source cloud
  to another target cloud.
Runbook: Determine if this occurred as a result of a valid business request.
Tags:
  - Snowflake
  - '[MITRE] Exfiltration'
  - '[MITRE] Transfer Data to Cloud Account'
Tests:
  - Name: Zero byte transfer
    ExpectedResult: false
    Log:
      {
        "REGION": "US-EAST-2",
        "SOURCE_CLOUD": "AWS",
        "SOURCE_REGION": "US-EAST-2",
        "TARGET_CLOUD": "AWS",
        "TARGET_REGION": "EU-WEST-1",
        "BYTES_TRANSFERRED": 0,
        "TRANSFER_TYPE": "COPY"
      }
  - Name: Disallowed Share
    ExpectedResult: true
    Log:
      {
        "REGION": "US-EAST-2",
        "SOURCE_CLOUD": "AWS",
        "SOURCE_REGION": "US-EAST-2",
        "TARGET_CLOUD": "AWS",
        "TARGET_REGION": "EU-WEST-1",
        "BYTES_TRANSFERRED": 61235879,
        "TRANSFER_TYPE": "COPY"
      }


# ------ paired body: snowflake_stream_external_shares.py ------

def rule(event):
    return all(
        [
            event.get("SOURCE_CLOUD"),
            event.get("TARGET_CLOUD"),
            event.get("BYTES_TRANSFERRED", 0) > 0,
        ]
    )


def title(event):
    return (
        f"A data export has been initiated from source cloud "
        f"{event.get('SOURCE_CLOUD', '<UNKNOWN SOURCE CLOUD>')} "
        f"in source region {event.get('SOURCE_REGION', '<UNKNOWN SOURCE REGION>')} "
        f"to target cloud {event.get('TARGET_CLOUD', '<UNKNOWN TARGET CLOUD>')} "
        f"in target region {event.get('TARGET_REGION', '<UNKNOWN TARGET REGION>')} "
        f"with transfer type {event.get('TRANSFER_TYPE', '<UNKNOWN TRANSFER TYPE>')} "
        f"for {event.get('BYTES_TRANSFERRED', '<UNKNOWN VOLUME>')} bytes"
    )