Skip to Content
Run ReportsContinuous Data Exports

Export Data to Snowflake

Set up continuous export of assets, vulnerabilities, and scan results from Mondoo to a Snowflake database.

Export your Mondoo security data to Snowflake so you can run SQL queries, build dashboards, and join it with other datasets in your warehouse. For how exports work in general, read Continuous Data Exports.

Mondoo data in Snowflake

Requirements

  • A Snowflake account with a database, warehouse, and schema already defined. See the Snowflake documentation for setup.
  • A Snowflake user for Mondoo to sign in as, set up for key-pair authentication or holding a programmatic access token. To learn how, read Set up authentication for the Mondoo user.
  • Editor or Owner access to the Mondoo space.

Find your Snowflake account identifier and region

Mondoo needs the account identifier and region ID for your Snowflake account.

  1. Log into the Snowflake web UI.

  2. At the bottom-left of the window, select the dropdown beside the Snowflake logo, then hover over your user ID for the account.

    Find your Snowflake account ID

  3. Note the Locator value. This is the account identifier Mondoo needs.

  4. Note the Region ID. Snowflake shows a description like US Central 1 (Iowa); Mondoo needs the ID form like us-central1.gcp.

Set up authentication for the Mondoo user

Mondoo signs in to Snowflake with one of two methods:

  • Key pair. Mondoo holds the user's private RSA key and Snowflake holds the matching public key. This is the default, and the best choice for a service user.
  • Programmatic access token. A token that Snowflake issues to the user. Tokens expire, so you must create a new one and update the integration before the current one runs out.

Snowflake blocks password sign-in on most accounts, so new integrations don't offer a password.

  1. Generate an unencrypted private RSA key in PKCS#8 format, and the public key that goes with it:

    openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

    Mondoo doesn't accept a key protected by a passphrase.

  2. In Snowflake, assign the public key to the Mondoo user. Use the contents of rsa_key.pub without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines:

    ALTER USER MONDOO_USER SET RSA_PUBLIC_KEY='MIIBIjANBgkqh...';

  3. Keep rsa_key.p8. You upload it to Mondoo when you create the integration.

To learn more, read Key-pair authentication and key-pair rotation in the Snowflake documentation.

Create the integration

  1. In the Mondoo App, navigate to the space. In the side navigation, select Integrations, then select INSTALL. Under Data Exports, select Snowflake.

    The Install Integration page in Mondoo with the Data Exports category selected, showing the export destinations

  2. Under Choose an integration name, enter a name for the integration.

    The Snowflake export integration form in Mondoo, with the integration name and the start of the account credentials section

  3. Under Configure Snowflake account credentials, fill in:

    • Account Identifier. The Locator value from above.
    • Region. The region ID from above.
    • User. The Snowflake user Mondoo signs in as.

  4. Choose how Mondoo authenticates with Snowflake:

    • Key pair. Select UPLOAD PRIVATE RSA KEY and choose your rsa_key.p8 file, or paste the key into the text box.
    • Programmatic access token. Paste the token secret.

  5. Under Configure Snowflake destination, enter the Warehouse, Database, and Schema Mondoo writes to.

  6. Select CREATE INTEGRATION.

Mondoo starts the initial export. When it completes, the integration's status becomes ACTIVE and subsequent exports run automatically about every 24 hours.

Change how the integration authenticates

To rotate a key or token, or to move an existing integration to another authentication method, open the integration and select the pencil icon. Use the same Snowflake user the integration already signs in as.

  • Rotate the secret. Upload or paste the new private RSA key, or paste the new programmatic access token, then save.
  • Switch methods. Choose Key pair or Programmatic access token and provide the new secret. On some integrations this option is under Switch authentication method, and it requires permission to create and read credentials.

An integration created before key pairs and tokens were available still signs in with a password. Because Snowflake blocks password sign-in on most accounts, switch it to a key pair or a programmatic access token to keep it exporting.

Manage this integration

After it's created, find your integration under Integrations in your space's side navigation. Select it to open the detail page, where you can:

  • Trigger a manual export. Exports run automatically about every 24 hours. To export immediately, select RUN.
  • Check the status. ACTIVE means the integration is healthy and exporting on schedule. PENDING means Mondoo hasn't attempted the first export yet. ERROR means the last export failed. The Export Details section shows when the last export succeeded and when Mondoo last attempted one.
  • Review the activity log. Most Recent Activity lists each export run's messages, such as when a job started, finished, or failed and why. Filter it to errors, warnings, or info messages.
  • Change the settings. Select the pencil icon to edit the integration, for example to update credentials.
  • Remove the integration. Select the trash can icon and confirm. Mondoo stops future exports but does not delete data that has already been exported.

Next steps

PostgreSQL

Set up continuous export of assets, vulnerabilities, and scan results from Mondoo to a PostgreSQL database.

Google Security Command Center

Send Mondoo findings to Google Security Command Center using Workload Identity Federation or a service account key.

On this page

RequirementsFind your Snowflake account identifier and regionSet up authentication for the Mondoo userCreate the integrationChange how the integration authenticatesNext steps