Trust Center overview¶

You can use the Trust Center to evaluate, monitor, and reduce potential security risks in your Snowflake accounts. The Trust Center evaluates each Snowflake account against recommendations that are specified in scanners. Scanners might generate findings. Trust Center findings provide information about how to reduce potential security risks in your Snowflake account. Not every scanner run generates a finding. A scanner run that finds no security concern generates no finding in the Trust Center. You can also use the Trust Center to configure proactive notifications that help you monitor your account for security risks.

Common Trust Center use cases¶

For more information about how to use the Trust Center to reduce security risks in your Snowflake account, see the following topics:

Limitations¶

Snowflake reader accounts aren’t supported.

Required roles¶

To view or manage scanners and their findings by using the Trust Center, a user with the ACCOUNTADMIN role must grant the SNOWFLAKE.TRUST_CENTER_VIEWER or SNOWFLAKE.TRUST_CENTER_ADMIN application role to your role.

The following table lists common tasks that you perform by using the Trust Center user interface, and the minimum application role that your role requires to perform those tasks:

Note

If you are using the Trust Center in the organization account, use the GLOBALORGADMIN role, not ACCOUNTADMIN, to grant the Trust Center application roles.

See the following table for information about which application roles you need to access specific tabs in the Trust Center:

Task	Trust Center tab	Minimum required application role	Notes
View detection findings	Detections	`SNOWFLAKE.TRUST_CENTER_VIEWER`	`SNOWFLAKE.TRUST_CENTER_ADMIN` role can also view detections.
View violation findings	Violations	`SNOWFLAKE.TRUST_CENTER_VIEWER`	`SNOWFLAKE.TRUST_CENTER_ADMIN` role can also view violations.
Manage violation findings Lifecycle	Violations	`SNOWFLAKE.TRUST_CENTER_ADMIN`	None.
Manage scanner packages	Manage scanners	`SNOWFLAKE.TRUST_CENTER_ADMIN`	None.
Manage scanners	Manage scanners	`SNOWFLAKE.TRUST_CENTER_ADMIN`	None.
View org-level violations	Organization	`ORGANIZATION_SECURITY_VIEWER` and `SNOWFLAKE.TRUST_CENTER_ADMIN`	The Organization tab is visible only in an Organization account.

You can create a custom role that provides view-only access to the Violations and Detections tabs. You can also create a separate, administrator-level role to manage violations and scanners by using the Violations and Manage scanners tabs. For example, to create these two different roles, run the following commands:

USE ROLE ACCOUNTADMIN;

CREATE ROLE trust_center_admin_role;
GRANT APPLICATION ROLE SNOWFLAKE.TRUST_CENTER_ADMIN TO ROLE trust_center_admin_role;

CREATE ROLE trust_center_viewer_role;
GRANT APPLICATION ROLE SNOWFLAKE.TRUST_CENTER_VIEWER TO ROLE trust_center_viewer_role;

GRANT ROLE trust_center_admin_role TO USER example_admin_user;

GRANT ROLE trust_center_viewer_role TO USER example_nonadmin_user;

Copy

Note

This example isn’t intended to recommend a complete role hierarchy for using the Trust Center. For more information, see each sub-section in Using the Trust Center.

Using private connectivity with Trust Center¶

The Trust Center supports private connectivity. For more information, see Using private connectivity.

Trust Center findings¶

Trust Center findings include two kinds of findings: violations and detections. Both findings are generated by scanners as they run in your Snowflake accounts.

You can review findings at the organization level or you can examine more closely the findings for a specific account.

Note

Currently, you can’t view detection findings at the organization level.

Organization-level findings¶

The Organization tab provides insights into the violation findings that are generated in all of the accounts in the organization. This tab includes the following information:

The number of violations in the organization.
The accounts with the most critical violations.
The number of violations for each account in the organization. You can select an account to drill down into the individual violations in the account.

Note

You can’t use the Organization tab to resolve or reopen violations. To perform these actions, sign in to the account with the violation, and then access the Violations tab.

To access the Organization tab, you must meet the following requirements:

Sign in to the organization account.
Use a role that has the ORGANIZATION_SECURITY_VIEWER application role. You must also have a Trust Center application role.

Account-level findings¶

Scanners find and report violations and detections findings through the Trust Center. A violation persists over time and represents a configuration that doesn’t conform with a scanner’s requirements. A detection occurs one time and represents a unique event. You can use the Trust Center to view and manage findings for your account. For more information, see Using the Trust Center.

Violations¶

A scanner can examine an entity at any point and determine whether it is in violation based only on its current configuration. Scanners continue to report on violations unless you change the configuration to remediate the violations. For example, a scanner reports a violation if some users haven’t configured multi-factor authentication (MFA).

The Violations tab provides account-level information about scanner results. It includes the following information:

A graph of scanner violations over time, color coded by low, medium, high, and critical severity.
An interactive list for each violation that is found. Each row in the list contains details about the violation, when the scanner was last run, and how to remediate the violation.

Violations let you identify Snowflake configurations in the account that violate the requirements of enabled scanner packages. For each violation, the Trust Center provides an explanation of how to remediate the violation. After you remediate a violation, the violation still appears in the Violations tab until the next scheduled run of the scanner package containing the scanner that reported the violation begins, or until you run the scanner package manually.

When you are signed in to the account with the violations, you can use the Violations tab to perform the following actions:

Triage the violations that apply to you and record evidence or progress notes.
Resolve or reopen violations for any reason and record justification for audit needs.
Sort or filter violations by severity, scanner package, scanner version, scanned time, updated time, or status.
Add reasons for a violation status change to provide a clear record of actions taken.

You can remediate violations by changing the configuration. For a violation, the Trust Center provides suggestions for remediation. After you remediate the issue, the Trust Center no longer reports the violation. You can also manage the lifecycle of a violation finding by changing its status to Resolved. Email notifications are suppressed for resolved violations. Suppression prevents more notifications while you work to remediate the underlying misconfigurations. A resolved violation finding no longer generates a notification.

Detections¶

A detection represents an event that happened at a specific time. The following findings are examples of events that might be reported as detections:

Login events originated from an unrecognized IP address.
A large amount of data was transferred to an external stage.
A task had a high error rate between two points in time.

Scanners report each detection based on an event trigger. For example, a scanner reports a detection when it detects a suspicious sign-in event and reports a separate detection when it detects another suspicious sign-in event at a different time. For a detection, the Trust Center provides information about the event. Because the event is unique and happened in the past, direct remediation of a detection isn’t possible.

Based on the information that the Trust Center provides, you can investigate whether the detection is meaningful. If the detection is meaningful, you can take actions to prevent similar events in the future.

Note

If the scanner that reported the detection runs again, it might or might not report similar detections. Currently, you can’t manage the lifecycle of a detection.

For more information about managing detections, see View detections.

Scanners¶

A scanner is a background process that checks your account for security risks that are based on the following criteria:

How you configured your account.
Anomalous events.

The Trust Center groups scanners into scanner packages. Scanner details provide information about what security risks the scanner checks for in your account, when the scanner runs, and who receives notifications about the scanner’s findings for your account. To see the details for a specific scanner, follow the instructions in View details for a scanner.

Schedule-based scanners¶

Schedule-based scanners run at specific times, according to their schedules. You must enable a scanner package before you can change the schedule for a scanner. For more information about changing the schedule for a scanner, see Change the schedule for a scanner.

Event-driven scanners¶

Event-driven scanners generate detections that are based on relevant events. Examples include scanners that detect sign-ins from unusual IP addresses and scanners that detect changes to sensitive parameters. You can’t schedule an event-driven scanner, because an event, not a schedule, drives the detection that an event-driven scanner generates. The Trust Center reports detections that are generated by event-driven scanners within an hour of the time that an event occurs.

An event-based scanner can detect events that a schedule-based scanner could miss. For example, consider a schedule-based scanner that detects the TRUE or FALSE state of a Boolean parameter once every 10 minutes. Toggling — that is, changing the state of — the value of that parameter from TRUE to FALSE, and then back to TRUE again before 10 minutes pass would occur undetected by the schedule-based scanner. An event-based scanner that detects each state change would detect both events.

For a current list of event-driven scanners, see Threat Intelligence scanner package.

Note

Event-driven scanners might appear as multiple items in the METERING_HISTORY view.

Scanner Packages¶

Scanner packages contain a description and a list of scanners that run when you enable the scanner package. After you enable a scanner package, the scanner package runs immediately, regardless of the configured schedule. After you enable a scanner package, you can enable or disable individual scanners in the scanner package. Your role must have the SNOWFLAKE.TRUST_CENTER_ADMIN application role to manage scanners by using the Manage scanners tab. For more information, see Required roles.

The following scanner packages are available:

Security Essentials scanner package
CIS Benchmarks scanner package
Threat Intelligence scanner package

For information about enabling scanner packages, the cost that can occur from enabled scanners, how to change the schedule for a scanner package, and how to view the list of current scanners in a package, see the following topics:

Scanner packages are deactivated by default, except for the Security Essentials scanner package.

Security Essentials scanner package¶

The Security Essentials scanner package scans your account to check whether you have set up the following recommendations:

You have an authentication policy that enforces all human users to enroll in MFA if they use passwords to authenticate.
All human users are enrolled in MFA if they use passwords to authenticate.
You set up an account-level network policy that was configured to only allow access from trusted IP addresses.
You set up an event table if your account enabled event sharing for a native app, so your account receives a copy of the log messages and event information that is shared with the application provider.

This scanner package only scans users that are human users; that is, user objects with a TYPE property of PERSON or NULL. For more information, see Types of users.

The Security Essentials scanner package:

Is enabled by default. You can’t deactivate it.
Runs once a month. You can’t change this schedule.
Is a free scanner package that doesn’t incur serverless compute cost.

CIS Benchmarks scanner package¶

You can access additional security insights by enabling the CIS Benchmarks scanner package, which contains scanners that evaluate your account against the Center for Internet Security (CIS) Snowflake Benchmarks. The CIS Snowflake Benchmarks are a list of best practices for Snowflake account configurations meant to reduce security vulnerabilities. The CIS Snowflake Benchmarks were created through community collaboration and consensus among subject matter experts.

To obtain a copy of the CIS Snowflake Benchmarks document, see the CIS Snowflake Benchmark website.

The recommendations found in the CIS Snowflake Benchmarks are numbered by section and recommendation. For example, the first recommendation of the first section is numbered 1.1. In the Violations tab, the Trust Center provides section numbers for each violation if you want to reference the Snowflake CIS Benchmarks.

This scanner package runs once a day by default, but you can change the schedule.

Note

For specific Snowflake CIS benchmarks, Snowflake only determines whether you have implemented a specific security measure, but does not evaluate whether the security measure was implemented in a way that achieves its objective. For these benchmarks, the absence of a violation does not guarantee that the security measure is implemented in an effective manner. The following benchmarks either do not evaluate whether your security implementations were implemented in a way that achieve their goal, or the Trust Center does not perform checks for them:

All of section 2: Ensure that activities are monitored and provide recommendations for configuring Snowflake to address activities that require attention. These scanners contain complex queries whose violations don’t appear in the Snowsight console.

A security officer can derive valuable insights from section 2 scanners by executing the following query against the snowflake.trust_center.findings view:
```
SELECT start_timestamp,
       end_timestamp,
       scanner_id,
       scanner_short_description,
       impact,
       severity,
       total_at_risk_count,
       AT_RISK_ENTITIES
  FROM snowflake.trust_center.findings
  WHERE scanner_type = 'Threat' AND
        completion_status = 'SUCCEEDED'
  ORDER BY event_id DESC;
```
Copy
In the output, the AT_RISK_ENTITIES column contains JSON content with details about activities that require review or remediation. For example, the CIS_BENCHMARKS_CIS2_1 scanner monitors high privilege grants, and security officers should review events reported by this scanner carefully, such as the following sample event:
```
[
  {
    "entity_detail": {
      "granted_by": joe_smith,
      "grantee_name": "SNOWFLAKE$SUSPICIOUS_ROLE",
      "modified_on": "2025-01-01 07:00:00.000 Z",
      "role_granted": "ACCOUNTADMIN"
    },
    "entity_id": "SNOWFLAKE$SUSPICIOUS_ROLE",
    "entity_name": "SNOWFLAKE$SUSPICIOUS_ROLE",
    "entity_object_type": "ROLE"
  }
]
```
Snowflake suggests the following best practices for section 2 scanners:
- Don’t disable section 2 scanners unless you’re confident that you have sufficient monitoring measures in place.
- Inspect the violations of section 2 scanners on a regular cadence or configure a monitoring task for detections. Specifically, configure monitoring as described in the SUGGESTED_ACTION column of the snowflake.trust_center.findings view.
3.1: Ensure that an account-level network policy was configured to only allow access from trusted IP addresses. Trust Center displays a violation if you don’t have an account-level network policy, but doesn’t evaluate whether the appropriate IP addresses have been allowed or blocked.
4.3: Ensure that the DATA_RETENTION_TIME_IN_DAYS parameter is set to 90 for critical data. Trust Center displays a violation if the DATA_RETENTION_TIME_IN_DAYS parameter associated with Time Travel isn’t set to 90 days for the account or at least one object, but doesn’t evaluate which data is considered critical.
4.10: Ensure that data masking is enabled for sensitive data. Trust Center displays a violation if the account does not have at least one masking policy, but does not evaluate whether sensitive data is protected appropriately. The Trust Center does not evaluate whether a masking policy is assigned to at least one table or view.
4.11: Ensure that row-access policies are configured for sensitive data. Trust Center displays a violation if the account doesn’t have at least one row access policy, but does not evaluate whether sensitive data is protected. The Trust Center does not evaluate whether a row access policy is assigned to at least one table or view.

Threat Intelligence scanner package¶

You can access additional security insights in the Trust Center by enabling the Threat Intelligence scanner package. This package identifies risks based on the following criteria:

User types: Whether a Snowflake account user is a human or a service.
Authentication methods or policies: Whether a user logs in to their account with a password without being enrolled in MFA.
Login activity: Whether a user hasn’t logged in recently.
Abnormal failure rates: Whether a user has a high number of authentication failures or job errors.
New! Detection findings: all new scanners that report detection findings.

Specific scanners in the Threat Intelligence package identify users that demonstrate potentially risky behavior as risky. The following table provides examples:

Threat Intelligence scanners¶

Scanner	Type	Description
Migrate human users away from password-only sign-in	Schedule-based	Identifies human users who (a) haven’t set up MFA and signed in with a password at least once in the past 90 days and (b) have a password but haven’t set up MFA and haven’t signed in for 90 days.
Migrate legacy service users away from password-only sign-in	Schedule-based	Identifies legacy service users who have a password and (a) have signed in with only a password at least once in the past 90 days and (b) haven’t signed in for 90 days.
Identify users with a high volume of authentication failures	Schedule-based	Identifies users with a high number of authentication failures or job errors, which might indicate attempted takeovers of an account, misconfigurations, exceeded quotas, or permission issues. Provides a risk-severity finding and a risk-mitigation recommendation.

New Threat Intelligence scanners¶

Both schedule-based scanners and event-based scanners can report detections. This preview adds new scanners of both types. All of the added scanners generate detections instead of violation findings.

This preview adds the following new scanners to the Threat Intelligence scanner package:

Scanner	Type	Description
Authentication policy changes	Event-driven	Finds changes to authentication polices at both the account level and the user level.
Dormant user sign-ins	Event-driven	Analyzes sign-in history events and flags sign-ins from users who haven’t signed in during the last 90 days.
Entities with long-running queries	Schedule-based	Finds users and query IDs associated with long-running queries, which are queries with durations that are two standard deviations away from an average query duration over the last 7 days, or the last time the scanner ran, whichever is more recent. We recommend setting this scanner to run once a day. This scanner might cost more initially, as it builds a 30-day cache, which it stores thereafter. Trust Center reports a detection event the first time this scanner runs.
Login protection	Event-driven	Finds recent logins from unusual IP addresses. Important These events originate from the Malicious IP Protection service and require immediate attention.
Sensitive parameter protection	Event-driven	Reports disablement of the following sensitive account-level parameters: PREVENT_UNLOAD_TO_INLINE_URL, REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION, and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION. This scanner only reports detections of a change from `TRUE` to `FALSE` for these parameters, which are set to `TRUE` by default for the best security posture.
Users with administrator privileges	Schedule-based	Finds newly created users whose default role is an administrator role, as well as recent grants to existing users that grant them an administrator role.
Users with unusual applications used in sessions	Schedule-based	Finds users who have used unusual client applications that connect to Snowflake.

The Threat Intelligence scanner package runs once a day by default, but you can change the schedule.

Next steps¶

Getting started with the Trust Center