Snowflake CCF - Connector - Parse/normalize data

[mcentcw]

Is your feature request related to a problem? Please describe.
Currently the Snowflake CCF connector doesn't appear to parse the returned data from Snowflake into separate fields/columns and instead places each row's contents in a generic "Data" column.

This makes it difficult to filter and understand the data.

Describe the solution you'd like
For each custom Snowflake table schema, include their respective columns/fields and parse the returned data into it.

[v-sudkharat]

Hi @mcentcw, Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!

[v-tsawant]

Hi @mcentcw , Currently, the Snowflake CCF connector ingests all data from your Snowflake source into a single "Data" column within Microsoft Sentinel. This design means that, by default, the raw event data is captured in a generic column, without automatic separation into individual fields based on your custom table schema.

To address this, we provide a dedicated parser for the Snowflake CCF connector. This parser is designed to extract the relevant fields from the single "Data" column and map them to their respective columns as defined in your custom schema. By applying this parser, you can normalize the ingested data, enabling you to filter, query, and visualize your Snowflake events using distinct fields in Microsoft Sentinel.

We recommend utilizing the Snowflake CCF parser to transform the raw ingested data into a structured format that aligns with your custom schema. This will allow you to leverage the full range of Sentinel’s filtering and analytical capabilities for your Snowflake data.

If you need guidance on how to apply the parser or customize it for your schema, please let us know. Thanks!

[v-tsawant]

Hi @mcentcw, Gentle Reminder: We are waiting for your response on this issue. If you still need to keep this issue active, please respond to it in the next 2 days. If we don't receive a response by 13-08-2025 date, we will be closing this issue.
Thanks!

[v-tsawant]

Hi @mcentcw , As there is no response from the Author after gentle reminder Issue has been closed as per our standard operating procedures.

[mcentcw]

Thank you @v-tsawant ,

I was able to delete the duplicate "Snowflake" function parser that generated an duplicate function error.
I also deleted references in the parser code to the Snowflake_CL table (that exists only when using the old Functions connector) that caused the parser code to fail, and was able to invoke it manually to preview the parsed logs into segregated fields.

If possible, would you be able to provide guidance on how to apply the parser and persist the parsed data into Sentinel?