Remove Snowflake.Stream.AttemptedLoginByDisabledUser and assc. query (#…

…1444)
panther-labs · Dec 9, 2024 · f8f7890 · f8f7890
1 parent 5f0db64
commit f8f7890
Show file tree

Hide file tree

Showing 5 changed files with 3 additions and 80 deletions.
diff --git a/deprecated.txt b/deprecated.txt
@@ -34,4 +34,6 @@ Okta.GeographicallyImprobableAccess
 Okta.BruteForceLogins
 Query.Snowflake.PublicRoleGrant
 Snowflake.PublicRoleGrant
-GCP.K8S.Pot.Create.Or.Modify.Host.Path.Volume.Mount
+GCP.K8S.Pot.Create.Or.Modify.Host.Path.Volume.Mount
+Snowflake Attempted Login With Disabled User
+Snowflake.Stream.AttemptedLoginByDisabledUser
diff --git a/packs/snowflake_streaming.yml b/packs/snowflake_streaming.yml
@@ -9,13 +9,11 @@ PackDefinition:
     # Helpers
     - panther_snowflake_helpers
     # Queries
-    - Snowflake Attempted Login With Disabled User
     - Snowflake User Daily Query Volume Spike
     - Snowflake User Daily Query Volume Spike - Threat Hunting
     - Suspicious Snowflake Sessions - Unusual Application
     # Rules
     - Snowflake.Stream.AccountAdminGranted
-    - Snowflake.Stream.AttemptedLoginByDisabledUser
     - Snowflake.Stream.BruteForceByIp
     - Snowflake.Stream.BruteForceByUsername
     - Snowflake.Stream.ExternalShares

diff --git a/queries/snowflake_queries/snowflake_attempted_login_by_disabled_user.py b/queries/snowflake_queries/snowflake_attempted_login_by_disabled_user.py
diff --git a/queries/snowflake_queries/snowflake_attempted_login_by_disabled_user.yml b/queries/snowflake_queries/snowflake_attempted_login_by_disabled_user.yml
diff --git a/queries/snowflake_queries/snowflake_attempted_login_by_disabled_user_query.yml b/queries/snowflake_queries/snowflake_attempted_login_by_disabled_user_query.yml