Threat Detection across all environments with SnowflakeData Security Lake
summary
Shows a working pipeline that writes a Snowflake security data lake, ingests raw feeds (AWS CloudTrail, CrowdStrike, Windows event logs, firewalls) and runs unified detectors that cross-correlate events into campaign stories. Demo ingests 28 TB and bubbles up 900 leads, joins low‑score EDR events with risky Azure sign‑ons to form a single story, finds six on‑prem hosts probing cloud storage, and exposes raw tables for custom queries. Pricing claim: Snowflake storage ~ $23/TB/month compressed.
AI-written summary · about
chapters (11)
- 0:00Introduction and overview
- 3:28What is an open XDR
- 7:44Hunters XDR platform
- 16:26Demo introduction and setup
- 16:48Data ingestion and analysis
- 21:18Threat detection and correlation
- 26:29Manual investigation and queries
- 31:50Next steps and use cases
- 36:04Addressing log security concerns
- 37:48Snowflake security and compliance
- 40:56Closing remarks and Q&A
related talks
41mFrom Snowflake to Snowstorm:Navigating Breaches and Detections
20mData lake deep dive: Using accelerated indexing for threat detection
12mSecurity data gravity: Visibility & threat detection for data lakes
28mBuilding A Governed Data Lake
17mArchitecting a security data lake at enterprise scale
13mClosing the security visibility gap
23mAcceleratinag Data Science and Machine Learning with Snowflake DataTech
17mStrengthening Security and Compliance in Our Data Platform