Snowflake queries minor fixes (#728)

panther-labs · Apr 13, 2023 · fea79d6 · fea79d6
1 parent 62427dc
commit fea79d6
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/queries/snowflake_queries/snowflake_public_role_grant_query.yml b/queries/snowflake_queries/snowflake_public_role_grant_query.yml
@@ -18,7 +18,7 @@ SnowflakeQuery: >
     end_time
   FROM snowflake.account_usage.query_history
     WHERE
-      p_occurs_since('1 h', start_time)
+      DATEDIFF(HOUR, start_time, CURRENT_TIMESTAMP) < 24
       AND execution_status = 'SUCCESS'
       AND query_type = 'GRANT'
       AND query_text ILIKE '%to%public%'

diff --git a/queries/snowflake_queries/snowflake_user_created_query.yml b/queries/snowflake_queries/snowflake_user_created_query.yml
@@ -19,7 +19,7 @@ SnowflakeQuery: >
     role_name
   FROM snowflake.account_usage.query_history
     WHERE
-      p_occurs_since('24 h', start_time)
+      DATEDIFF(HOUR, start_time, CURRENT_TIMESTAMP) < 24
       AND execution_status = 'SUCCESS'
       AND query_type = 'CREATE_USER'
       AND query_text ILIKE '%create%user%'

diff --git a/queries/snowflake_queries/snowflake_user_enabled_query.yml b/queries/snowflake_queries/snowflake_user_enabled_query.yml
@@ -19,7 +19,7 @@ SnowflakeQuery: >
     role_name
   FROM snowflake.account_usage.query_history
     WHERE
-      p_occurs_since('24 h', start_time)
+      DATEDIFF(HOUR, start_time, CURRENT_TIMESTAMP) < 24
       AND execution_status = 'SUCCESS'
       AND query_type = 'ALTER_USER'
       AND (query_text ILIKE '%alter user%set disabled = false%'