Trailox for Snowflake
Understand who is actually querying your Snowflake data.
Monitor actual query and access activity across users, roles, applications and tables. Detect behavioral changes and investigate historical activity across every warehouse.
Stolen credential suspected
Snowflake
- Identity
- svc_reporting, user with role ANALYST
- Client
- New driver, first seen for this user
- Table
- CUSTOMERS, never read by this role
- Volume
- Far above this role's baseline
Next step: Disable the user, then use the same record to see what it read.
What it shows
What Trailox shows in Snowflake
- Every query, attributed: the user, role and tool behind it.
- Tables touched: the tables each query read.
- Copies out: alerts when data is copied out of Snowflake.
- History: search past query activity by user, role, table or warehouse.
Detections
Behavioral detections for Snowflake
What it catches
- Stolen credentials that still log in
- Data copied out of Snowflake
- Service accounts and AI agents reading outside their task
- Insider misuse by a valid user
Public case
In June 2024, Mandiant reported that a group logged in to Snowflake customer accounts with credentials stolen by infostealer malware. The logins were valid, but the behavior was not. Trailox was not involved in these incidents.
Read the Mandiant reportFAQ
Questions buyers ask
Does Trailox read my Snowflake tables?
No. Trailox reads access logs and metadata only. Your data is never read.
Is anything deployed inside my Snowflake account?
No. Nothing is deployed inside your Snowflake account.
How do we start?
With a free 14-day Data Access Review. Read-only. First findings in 48 hours.
Start with proof,
not a pitch.
Free 14-day Data Access Review. Read-only. First findings in 48 hours.