Custom Audit Logs

Custom Audit Logs let you send your own application-defined events into ALTR’s Database Activity Monitoring audit pipeline, extending capture beyond the query types ALTR captures by default on Snowflake (SELECT queries on connected data) — typical uses include login events, GRANT/REVOKE statements, password changes, and other DDL/DML/DCL activity. Contact ALTR to enable Custom Audit Logs for your account.

Prerequisites

Before you can send Custom Audit Logs, you need:

• Custom Audit Logs enabled for your account — contact ALTR; enabling it requires ALTR to provision account-side infrastructure, including the endpoint your external function calls.
• A Snowflake external function that you create and configure to call that endpoint through Snowflake’s API Gateway integration.
• Snowflake-side automation you author — tasks, streams, or stored procedures — that invokes the function with event data.
• Amazon S3 Integration configured, since Custom Audit Logs are accessible only through S3 export.

How Custom Audit Logs Work

Custom Audit Logs send events from a Snowflake external function that calls ALTR’s Custom Audit Log endpoint through Snowflake’s API Gateway integration, so Custom Audit Logs are available only for Snowflake data sources. Snowflake tasks, streams, or stored procedures typically invoke the function with event data.

Events are sent as JSON batches, up to 256 KB per batch. The event schema is customer-defined — ALTR doesn’t enforce a specific event structure beyond the batch size limit.

Caution

ALTR doesn’t sanitize or redact custom audit events. Remove sensitive values from event payloads before sending them.

Accessing Custom Audit Logs

Custom audit events flow into the same S3 storage as standard Database Activity Monitoring data, but they’re accessible only through Amazon S3 Integration. They don’t appear in the Activity Monitoring Dashboard or Query Log, and they aren’t evaluated by DAM Alerting or Policy Alerts.

Custom Audit Task Example

The following Snowflake task sends hourly login history events to ALTR as custom audit logs, using Snowflake’s task scheduling:

CREATE OR REPLACE TASK LOGIN_AUDIT_TASK
  SCHEDULE = '60 MINUTE'
AS
  SELECT "ALTR_DSAAS_DB"."<YOUR_SCHEMA_NAME>"."<YOUR_FUNCTION_NAME>"(
    SELECT ARRAY_AGG(event_details) WITHIN GROUP (ORDER BY event_details ASC)
    FROM (
      SELECT TO_JSON(OBJECT_CONSTRUCT_KEEP_NULL(
        'event_type', event_type,
        'user_name', user_name,
        'client_ip', client_ip,
        'is_success', is_success,
        'event_time', event_timestamp
      )) AS event_details
      FROM TABLE(information_schema.login_history(
        TIME_RANGE_START => DATEADD('hours', -1, CURRENT_TIMESTAMP()),
        TIME_RANGE_END => CURRENT_TIMESTAMP()
      ))
    )
  );

ALTER TASK LOGIN_AUDIT_TASK RESUME;

The schema and function names are unique to your ALTR account. Your ALTR Organization ID is available from Settings and Preferences; the schema name is your organization ID with dashes replaced by underscores. To find the exact function name, run:

SHOW USER FUNCTIONS LIKE 'ALTR_CUSTOM_AUDIT_%' IN SCHEMA ALTR_DSAAS_DB.<YOUR_SCHEMA_NAME>;

This returns a single row with the full function name.