The IT Security team has identified an ongoing credential-stuffing attack across many of the organization’s systems.
What is the BEST method to find recent and ongoing login attempts to Snowflake?
The INFORMATION_SCHEMA.LOGIN_HISTORY table function returns Snowflake user login events within a specified recent time range; when no end time is specified, it returns the most recent login events. This makes it suitable for investigating active credential-stuffing activity. The ACCOUNT_USAGE.LOGIN_HISTORY view is intended for longer-term history and can have data latency.
INFORMATION_SCHEMA.LOGIN_HISTORY
ACCOUNT_USAGE.LOGIN_HISTORY
Community Discussion