From fea79d6dcd70bc753d2848838b9826df7f19d9aa Mon Sep 17 00:00:00 2001
From: andrea-youwakim <117778222+andrea-youwakim@users.noreply.github.com>
Date: Thu, 13 Apr 2023 10:05:50 -0600
Subject: [PATCH] Snowflake queries minor fixes (#728)

---
 queries/snowflake_queries/snowflake_public_role_grant_query.yml | 2 +-
 queries/snowflake_queries/snowflake_user_created_query.yml      | 2 +-
 queries/snowflake_queries/snowflake_user_enabled_query.yml      | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/queries/snowflake_queries/snowflake_public_role_grant_query.yml b/queries/snowflake_queries/snowflake_public_role_grant_query.yml
index 30db0a639..401816969 100644
--- a/queries/snowflake_queries/snowflake_public_role_grant_query.yml
+++ b/queries/snowflake_queries/snowflake_public_role_grant_query.yml
@@ -18,7 +18,7 @@ SnowflakeQuery: >
     end_time
   FROM snowflake.account_usage.query_history
     WHERE
-      p_occurs_since('1 h', start_time)
+      DATEDIFF(HOUR, start_time, CURRENT_TIMESTAMP) < 24
       AND execution_status = 'SUCCESS'
       AND query_type = 'GRANT'
       AND query_text ILIKE '%to%public%'
diff --git a/queries/snowflake_queries/snowflake_user_created_query.yml b/queries/snowflake_queries/snowflake_user_created_query.yml
index 01ce627b4..260014dc6 100644
--- a/queries/snowflake_queries/snowflake_user_created_query.yml
+++ b/queries/snowflake_queries/snowflake_user_created_query.yml
@@ -19,7 +19,7 @@ SnowflakeQuery: >
     role_name
   FROM snowflake.account_usage.query_history
     WHERE
-      p_occurs_since('24 h', start_time)
+      DATEDIFF(HOUR, start_time, CURRENT_TIMESTAMP) < 24
       AND execution_status = 'SUCCESS'
       AND query_type = 'CREATE_USER'
       AND query_text ILIKE '%create%user%'
diff --git a/queries/snowflake_queries/snowflake_user_enabled_query.yml b/queries/snowflake_queries/snowflake_user_enabled_query.yml
index b17c10506..3f7823e40 100644
--- a/queries/snowflake_queries/snowflake_user_enabled_query.yml
+++ b/queries/snowflake_queries/snowflake_user_enabled_query.yml
@@ -19,7 +19,7 @@ SnowflakeQuery: >
     role_name
   FROM snowflake.account_usage.query_history
     WHERE
-      p_occurs_since('24 h', start_time)
+      DATEDIFF(HOUR, start_time, CURRENT_TIMESTAMP) < 24
       AND execution_status = 'SUCCESS'
       AND query_type = 'ALTER_USER'
       AND (query_text ILIKE '%alter user%set disabled = false%'