Hey everyone! 👋 I was setting up long-term retention for our Lacework alerts and resource data in Snowflake this week, and while the overall process is straightforward, there were a few configuration nuances I thought I'd share.
The main benefit is cost-effective storage and the ability to join security findings with other business data. Lacework's built-in retention is great for daily ops, but for compliance or year-over-year trend analysis, pushing to your own Snowflake instance is a game-changer.
Here's the core setup. First, ensure you have a Snowflake account, a target database/schema, and a warehouse ready. You'll need a Lacework user with the `ORG_ADMIN` role to generate the integration credentials.
In Lacework, navigate to **Settings > Data Sources > Snowflake** and click "Add Integration". You'll be prompted for Snowflake details. Here's a sample of the configuration you need to prepare:
```sql
-- In Snowflake, create a role and user for Lacework
CREATE ROLE lacework_role;
CREATE USER lacework_user PASSWORD='' DEFAULT_ROLE=lacework_role;
-- Grant necessary privileges
GRANT USAGE ON WAREHOUSE my_warehouse TO ROLE lacework_role;
GRANT USAGE ON DATABASE my_security_db TO ROLE lacework_role;
GRANT USAGE ON SCHEMA my_security_db.lacework_schema TO ROLE lacework_role;
GRANT CREATE TABLE ON SCHEMA my_security_db.lacework_schema TO ROLE lacework_role;
GRANT INSERT ON ALL TABLES IN SCHEMA my_security_db.lacework_schema TO ROLE lacework_role;
```
Key points I learned:
* **Table Ownership:** Lacework needs `CREATE TABLE` in the target schema. It will create its own tables (like `LW_ALERTS`, `LW_CLOUD_EVENTS`).
* **Network Policy:** If your Snowflake has a network policy, allow Lacework's egress IPs (check their docs for the list).
* **Data Lag:** Expect about a 15-30 minute delay for data to appear in Snowflake; it's not real-time.
* **Partitioning:** The tables are date-partitioned by `INSERT_TIME`. Use this for efficient querying.
Once connected, you can run queries like this to correlate data:
```sql
SELECT ALERT_ID, ALERT_TITLE, ENTITIES_AFFECTED
FROM my_security_db.lacework_schema.LW_ALERTS
WHERE START_TIME >= DATEADD(day, -7, CURRENT_TIMESTAMP())
ORDER BY SEVERITY DESC;
```
A final best practice: set up a monitoring alert in Lacework for the integration's health status. You don't want a silent failure.
The documentation covers the basics, but I hope these specifics from a real implementation help someone out! It’s been solid for us so far.
Happy coding!
Clean code, happy life