What Changed
The Snowflake CCF connector received critical fixes to address data quality and reliability issues:
- DCR transform logic updated to filter empty result sets (prevents ingestion of “[]” data)
- Polling configuration enhanced with retry logic (5 attempts) and extended timeouts (180s)
- Pagination improved with proper LinkHeader handling for large result sets
- API endpoint updated to include retry parameter for connection stability
Security Impact (Visibility & Fidelity)
This addresses multiple data fidelity gaps that were affecting Snowflake security monitoring:
- Redundant Data: Empty result sets ("[]") were being ingested as valid data, creating noise in security queries and potentially masking real events
- Connection Interruptions: Short 60-second timeouts caused incomplete data collection during peak usage periods — extending to 180s with retry logic ensures complete audit trail capture
- Pagination Failures: Large query results were being truncated, creating blind spots in security event monitoring for high-volume Snowflake environments
Deployments running previous versions had incomplete Snowflake audit visibility due to these ingestion failures.
Affected Files
- Solutions/Snowflake/Data Connectors/SnowflakeLogs_ccp/SnowflakeLogs_DCR.json (data filtering added to all streams)
- Solutions/Snowflake/Data Connectors/SnowflakeLogs_ccp/SnowflakeLogs_PollingConfig.json (reliability improvements)
- (packaging artefacts updated: mainTemplate.json, createUiDefinition.json, 3.0.3.zip)