Detection rules › Panther
Snowflake Brute Force Attacks by IP
Detect brute force attacks by monitoring for failed logins from the same IP address
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1110 Brute Force |
Rule body yaml
AnalysisType: scheduled_rule
Filename: snowflake_brute_force_ip.py
RuleID: "Snowflake.BruteForceByIp"
DisplayName: "Snowflake Brute Force Attacks by IP"
Enabled: false
ScheduledQueries:
- Query.Snowflake.FailedLogins
Severity: Medium
Reports:
MITRE ATT&CK:
- TA0006:T1110
Description: >
Detect brute force attacks by monitoring for failed logins from the same IP address
Threshold: 5
SummaryAttributes:
- error_message
- error_code
- reported_client_type
- user_name
Tags:
- Snowflake
- Credential Access:Brute Force
Tests:
- Name: Value Returned By Query
ExpectedResult: true
Log:
client_ip: 1.2.3.4
count_by_ip: 100
- Name: Common Error
ExpectedResult: true
Log:
client_ip: 1.2.3.4
error_message: JWT_TOKEN_INVALID_PUBLIC_KEY_FINGERPRINT_MISMATCH
count_by_ip: 100
Detection logic
Filter
def rule(_):
return True
def title(event):
return (
f"Snowflake: {event.get('count_by_ip', 'many')} failed login attempts from IP "
f"[{event.get('client_ip','<UNKNOWN_USER>')}]"
)
def severity(event):
common_errors = {"JWT_TOKEN_INVALID_PUBLIC_KEY_FINGERPRINT_MISMATCH"}
if event.get("ERROR_MESSAGE") in common_errors:
return "INFO"
return "DEFAULT"
def dedup(event):
return f"[{severity(event)}] {title(event)}"
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
count_by_ip |
client_ip |