Trust Center overview¶

You can use the Trust Center to evaluate, monitor, and reduce potential security risks in your Snowflake accounts. The Trust Center evaluates each Snowflake account against recommendations that are specified in scanners. Scanners might generate findings. Trust Center findings provide information about how to reduce potential security risks in your Snowflake account. Not every scanner run generates a finding. A scanner run that finds no security concern generates no finding in the Trust Center. You can also use the Trust Center to configure proactive notifications that help you monitor your account for security risks.

Common Trust Center use cases¶

For more information about how to use the Trust Center to reduce security risks in your Snowflake account, see the following topics:

Limitations¶

Snowflake reader accounts aren't supported.

Required roles¶

To view or manage scanners and their findings by using the Trust Center, a user with the ACCOUNTADMIN role must grant the SNOWFLAKE.TRUST_CENTER_VIEWER or SNOWFLAKE.TRUST_CENTER_ADMIN application role to your role.

The following table lists common tasks that you perform by using the Trust Center user interface, and the minimum application role that your role requires to perform those tasks:

备注

If you are using the Trust Center in the organization account, use the GLOBALORGADMIN role, not ACCOUNTADMIN, to grant the Trust Center application roles.

请参阅下表，获取有关访问 Trust Center 特定选项卡所需的应用程序角色的信息：

Task	Trust Center 选项卡	Minimum required application role	Notes
View detection findings	Detections	`SNOWFLAKE.TRUST_CENTER_VIEWER`	`SNOWFLAKE.TRUST_CENTER_ADMIN` role can also view detections.
View violation findings	Violations	`SNOWFLAKE.TRUST_CENTER_VIEWER`	`SNOWFLAKE.TRUST_CENTER_ADMIN` role can also view violations.
Manage violation findings Lifecycle	Violations	`SNOWFLAKE.TRUST_CENTER_ADMIN`	None.
Manage scanner packages	Manage scanners	`SNOWFLAKE.TRUST_CENTER_ADMIN`	None.
Manage scanners	Manage scanners	`SNOWFLAKE.TRUST_CENTER_ADMIN`	None.
View org-level violations	Organization	`ORGANIZATION_SECURITY_VIEWER` and `SNOWFLAKE.TRUST_CENTER_ADMIN`	The Organization tab is visible only in an Organization account.

You can create a custom role that provides view-only access to the Violations and Detections tabs. You can also create a separate, administrator-level role to manage violations and scanners by using the Violations and Manage scanners tabs. For example, to create these two different roles, run the following commands:

USE ROLE ACCOUNTADMIN;

CREATE ROLE trust_center_admin_role;
GRANT APPLICATION ROLE SNOWFLAKE.TRUST_CENTER_ADMIN TO ROLE trust_center_admin_role;

CREATE ROLE trust_center_viewer_role;
GRANT APPLICATION ROLE SNOWFLAKE.TRUST_CENTER_VIEWER TO ROLE trust_center_viewer_role;

GRANT ROLE trust_center_admin_role TO USER example_admin_user;

GRANT ROLE trust_center_viewer_role TO USER example_nonadmin_user;

Copy

备注

This example isn't intended to recommend a complete role hierarchy for using the Trust Center. For more information, see each sub-section in 使用 Trust Center.

Using private connectivity with Trust Center¶

Trust Center 支持专用连接。有关更多信息，请参阅使用专用连接。

Trust Center findings¶

Trust Center findings include two kinds of findings: violations and detections. Both findings are generated by scanners as they run in your Snowflake accounts.

You can review findings at the organization level or you can examine more closely the findings for a specific account.

备注

Currently, you can't view detection findings at the organization level.

Organization-level findings¶

The Organization tab provides insights into the violation findings that are generated in all of the accounts in the organization. This tab includes the following information:

The number of violations in the organization.
The accounts with the most critical violations.
The number of violations for each account in the organization. You can select an account to drill down into the individual violations in the account.

备注

You can't use the Organization tab to resolve or reopen violations. To perform these actions, sign in to the account with the violation, and then access the Violations tab.

To access the Organization tab, you must meet the following requirements:

Sign in to the organization account.
Use a role that has the ORGANIZATION_SECURITY_VIEWER application role. You must also have a Trust Center application role.

Account-level findings¶

扫描器 find and report violations and detections findings through the Trust Center. A violation persists over time and represents a configuration that doesn't conform with a scanner's requirements. A detection occurs one time and represents a unique event. You can use the Trust Center to view and manage findings for your account. For more information, see 使用 Trust Center.

Violations¶

A scanner can examine an entity at any point and determine whether it is in violation based only on its current configuration. Scanners continue to report on violations unless you change the configuration to remediate the violations. For example, a scanner reports a violation if some users haven't configured multi-factor authentication (MFA).

The Violations tab provides account-level information about scanner results. It includes the following information:

随时间变化的扫描器违规图，按低、中、高和严重四个等级进行颜色编码。
An interactive list for each violation that is found. Each row in the list contains details about the violation, when the scanner was last run, and how to remediate the violation.

Violations 可以帮助您识别账户中违反启用的扫描器包要求的 Snowflake 配置。对于每个违规行为，Trust Center 都提供了如何纠正该违规行为的说明。在纠正违规行为后，该违规将仍然显示在 Violations 选项卡中，直到报告违规的下一个计划扫描器包开始运行，或者直到您手动运行扫描器包。

When you are signed in to the account with the violations, you can use the Violations tab to perform the following actions:

对适用于您的违规行为进行分类，记录证据或进度记录。
解决或重新打开任何原因的违规行为，并记录审计需求的理由。
Sort or filter violations by severity, scanner package, scanner version, scanned time, updated time, or status.
添加违规状态变更的原因，以清楚地记录所采取的行动。

You can remediate violations by changing the configuration. For a violation, the Trust Center provides suggestions for remediation. After you remediate the issue, the Trust Center no longer reports the violation. You can also manage the lifecycle of a violation finding by changing its status to Resolved. Email notifications are suppressed for resolved violations. Suppression prevents more notifications while you work to remediate the underlying misconfigurations. A resolved violation finding no longer generates a notification.

Detections¶

A detection represents an event that happened at a specific time. The following findings are examples of events that might be reported as detections:

Login events originated from an unrecognized IP address.
A large amount of data was transferred to an external stage.
A task had a high error rate between two points in time.

Scanners report each detection based on an event trigger. For example, a scanner reports a detection when it detects a suspicious sign-in event and reports a separate detection when it detects another suspicious sign-in event at a different time. For a detection, the Trust Center provides information about the event. Because the event is unique and happened in the past, direct remediation of a detection isn't possible.

Based on the information that the Trust Center provides, you can investigate whether the detection is meaningful. If the detection is meaningful, you can take actions to prevent similar events in the future.

备注

If the scanner that reported the detection runs again, it might or might not report similar detections. Currently, you can't manage the lifecycle of a detection.

For more information about managing detections, see View detections.

扫描器¶

A scanner is a background process that checks your account for security risks that are based on the following criteria:

How you configured your account.
Anomalous events.

The Trust Center groups scanners into scanner packages. Scanner details provide information about what security risks the scanner checks for in your account, when the scanner runs, and who receives notifications about the scanner's findings for your account. To see the details for a specific scanner, follow the instructions in 查看扫描器的详细信息.

Schedule-based scanners¶

Schedule-based scanners run at specific times, according to their schedules. You must enable a scanner package before you can change the schedule for a scanner. For more information about changing the schedule for a scanner, see Change the schedule for a scanner.

Event-driven scanners¶

Event-driven scanners generate detections that are based on relevant events. Examples include scanners that detect sign-ins from unusual IP addresses and scanners that detect changes to sensitive parameters. You can't schedule an event-driven scanner, because an event, not a schedule, drives the detection that an event-driven scanner generates. The Trust Center reports detections that are generated by event-driven scanners within an hour of the time that an event occurs.

An event-based scanner can detect events that a schedule-based scanner could miss. For example, consider a schedule-based scanner that detects the TRUE or FALSE state of a Boolean parameter once every 10 minutes. Toggling --- that is, changing the state of --- the value of that parameter from TRUE to FALSE, and then back to TRUE again before 10 minutes pass would occur undetected by the schedule-based scanner. An event-based scanner that detects each state change would detect both events.

For a current list of event-driven scanners, see Threat Intelligence 扫描器包.

备注

Event-driven scanners might appear as multiple items in the METERING_HISTORY 视图.

Scanner Packages¶

Scanner packages contain a description and a list of scanners that run when you enable the scanner package. After you enable a scanner package, the scanner package runs immediately, regardless of the configured schedule. After you enable a scanner package, you can enable or disable individual scanners in the scanner package. Your role must have the SNOWFLAKE.TRUST_CENTER_ADMIN application role to manage scanners by using the Manage scanners tab. For more information, see Required roles.

以下扫描器包可用：

Security Essentials 扫描器包
CIS Benchmarks 扫描器包
Threat Intelligence 扫描器包

For information about enabling scanner packages, the cost that can occur from enabled scanners, how to change the schedule for a scanner package, and how to view the list of current scanners in a package, see the following topics:

Scanner packages are deactivated by default, except for the Security Essentials 扫描器包.

Security Essentials 扫描器包¶

The Security Essentials scanner package scans your account to check whether you have set up the following recommendations:

You have an authentication policy that enforces all human users to enroll in MFA if they use passwords to authenticate.
如果使用密码进行身份验证，则所有人类用户都会注册 MFA。
You set up an account-level network policy that was configured to only allow access from trusted IP addresses.
如果您的账户启用了原生应用程序的事件共享，则设置事件表，您的账户将收到与应用程序提供商共享的日志消息和事件信息的副本。

This scanner package only scans users that are human users; that is, user objects with a TYPE property of PERSON or NULL. For more information, see 用户类型.

The Security Essentials scanner package:

Is enabled by default. You can't deactivate it.
Runs once a month. You can't change this schedule.
Is a free scanner package that doesn't incur serverless compute cost.

CIS Benchmarks 扫描器包¶

您可以通过启用 CIS Benchmarks 扫描器包来访问额外的安全洞察，该包中包含根据 Center for Internet Security (CIS) Snowflake Benchmarks 评估您的账户的扫描器。CIS Snowflake Benchmarks 是一系列 Snowflake 账户配置最佳实践，旨在减少安全漏洞。CIS Snowflake Benchmarks 是通过社区协作和主题专家达成共识创建的。

要获取 CIS Snowflake Benchmarks 文档的副本，请参阅 CIS Snowflake Benchmarks 网站 (https://www.cisecurity.org/benchmark/snowflake)。

在 CIS Snowflake Benchmarks 中找到的建议按章节和建议编号。例如，第一节中的第一个建议编号为 1.1。如果您要参考 Snowflake CIS Benchmarks，Trust Center 在 Violations 选项卡中，为每个违规提供了章节编号。

此扫描器包默认每天运行一次，但您可以更改计划。

备注

对于特定的 Snowflake CIS Benchmarks，Snowflake 仅确定您是否实施了特定的安全措施，但不评估安全措施是否以实现其目标的方式实施。对于这些基准测试，没有违规行为并不能保证安全措施以有效的方式实施。以下基准测试要么不评估您的安全实施是否以实现其目标的方式实施，要么 Trust Center 不对其进行检查：

第 2 节的全部内容：确保对活动进行监控，并提供有关配置 Snowflake 以处理需要注意的活动的建议。这些扫描器包含复杂的查询，其违规行为不会出现在 Snowsight 控制台中。

通过对 snowflake.trust_center.findings 视图执行以下查询，安全人员可以从第 2 部分扫描器中获得宝贵的见解：
```
SELECT start_timestamp,
       end_timestamp,
       scanner_id,
       scanner_short_description,
       impact,
       severity,
       total_at_risk_count,
       AT_RISK_ENTITIES
  FROM snowflake.trust_center.findings
  WHERE scanner_type = 'Threat' AND
        completion_status = 'SUCCEEDED'
  ORDER BY event_id DESC;
```
Copy
在输出中，AT_RISK_ENTITIES 列包含 JSON 内容，涉及有关需要审查或补救的活动的详细信息。例如，CIS_BENCHMARKS_CIS2_1 扫描器监控高权限授权，安全人员应仔细审查该扫描器报告的事件，例如以下示例事件：
```
[
  {
    "entity_detail": {
      "granted_by": joe_smith,
      "grantee_name": "SNOWFLAKE$SUSPICIOUS_ROLE",
      "modified_on": "2025-01-01 07:00:00.000 Z",
      "role_granted": "ACCOUNTADMIN"
    },
    "entity_id": "SNOWFLAKE$SUSPICIOUS_ROLE",
    "entity_name": "SNOWFLAKE$SUSPICIOUS_ROLE",
    "entity_object_type": "ROLE"
  }
]
```
Snowflake 为第 2 部分扫描器建议以下最佳实践：
- 除非您确信自己有充足的监控措施，否则不要禁用第 2 部分扫描器。
- Inspect the violations of section 2 scanners on a regular cadence or configure a monitoring task for detections. Specifically, configure monitoring as described in the SUGGESTED_ACTION column of the snowflake.trust_center.findings view.
3.1: Ensure that an account-level network policy was configured to only allow access from trusted IP addresses. Trust Center displays a violation if you don't have an account-level network policy, but doesn't evaluate whether the appropriate IP addresses have been allowed or blocked.
4.3：确保针对关键数据将 DATA_RETENTION_TIME_IN_DAYS 参数设置为 90。如果对于账户或至少一个对象，与 Time Travel 相关的 DATA_RETENTION_TIME_IN_DAYS 参数未设置为 90 天，则 Trust Center 会显示违规，但不会评估哪些数据属于关键数据。
4.10：确保为敏感数据启用数据掩码。如果账户没有至少一个掩码策略，则 Trust Center 会显示违规，但不会评估敏感数据是否得到适当保护。Trust Center 不会评估是否将掩码策略分配给至少一个表或视图。
4.11：确保为敏感数据配置行访问策略。如果账户没有至少一个行访问策略，则 Trust Center 会显示违规，但不会评估敏感数据是否得到保护。Trust Center 不会评估是否将行访问策略分配给至少一个表或视图。

Threat Intelligence 扫描器包¶

You can access additional security insights in the Trust Center by enabling the Threat Intelligence scanner package. This package identifies risks based on the following criteria:

User types: Whether a Snowflake account user is a human or a service.
Authentication methods or policies: Whether a user logs in to their account with a password without being enrolled in MFA.
Login activity: Whether a user hasn't logged in recently.
Abnormal failure rates: Whether a user has a high number of authentication failures or job errors.
New! Detection findings: all new scanners that report detection findings.

Specific scanners in the Threat Intelligence package identify users that demonstrate potentially risky behavior as risky. The following table provides examples:

Threat Intelligence scanners¶

Scanner	Type	Description
Migrate human users away from password-only sign-in	Schedule-based	Identifies human users who (a) haven't set up MFA and signed in with a password at least once in the past 90 days and (b) have a password but haven't set up MFA and haven't signed in for 90 days.
Migrate legacy service users away from password-only sign-in	Schedule-based	Identifies legacy service users who have a password and (a) have signed in with only a password at least once in the past 90 days and (b) haven't signed in for 90 days.
Identify users with a high volume of authentication failures	Schedule-based	Identifies users with a high number of authentication failures or job errors, which might indicate attempted takeovers of an account, misconfigurations, exceeded quotas, or permission issues. Provides a risk-severity finding and a risk-mitigation recommendation.

New Threat Intelligence scanners¶

Both schedule-based scanners and event-based scanners can report detections. This preview adds new scanners of both types. All of the added scanners generate detections instead of violation findings.

This preview adds the following new scanners to the Threat Intelligence 扫描器包:

Scanner	Type	Description
Authentication policy changes	Event-driven	Finds changes to authentication polices at both the account level and the user level.
Dormant user sign-ins	Event-driven	Analyzes sign-in history events and flags sign-ins from users who haven't signed in during the last 90 days.
Entities with long-running queries	Schedule-based	Finds users and query IDs associated with long-running queries, which are queries with durations that are two standard deviations away from an average query duration over the last 7 days, or the last time the scanner ran, whichever is more recent. We recommend setting this scanner to run once a day. This scanner might cost more initially, as it builds a 30-day cache, which it stores thereafter. Trust Center reports a detection event the first time this scanner runs.
Login protection	Event-driven	Finds recent logins from unusual IP addresses. 重要 These events originate from the Malicious IP Protection service and require immediate attention.
Sensitive parameter protection	Event-driven	Reports disablement of the following sensitive account-level parameters: PREVENT_UNLOAD_TO_INLINE_URL, REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION, and REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION. This scanner only reports detections of a change from `TRUE` to `FALSE` for these parameters, which are set to `TRUE` by default for the best security posture.
Users with administrator privileges	Schedule-based	Finds newly created users whose default role is an administrator role, as well as recent grants to existing users that grant them an administrator role.
Users with unusual applications used in sessions	Schedule-based	Finds users who have used unusual client applications that connect to Snowflake.

The Threat Intelligence scanner package runs once a day by default, but you can change the schedule.

后续步骤¶

Trust Center 入门