Snowflake red-team iter-8 — surface analytical depth in the deliverable, close detection-rule structural gaps

[AndrewAltimit]

Summary

Iter-7 self-audit found that the analytical depth (docs/analysis/, detection/snowflake/) consistently outran what reached the client-facing HTML report, and that three Sigma rules carried structural matching defects (over-firing or never-firing). This iteration closes both gaps end-to-end across 13 prioritized audit items.

Deliverable layer (reports/snowflake-platform-assessment/)

• New healthcare-overlay.html — HIPAA control mapping, MFA-boundary clarity (human vs. service), per-chain PHI impact map, OCR retention, engagement runbook. Surfaces the analytical companion at docs/analysis/snowflake-healthcare-overlay-2026.md.
• New incident-response.html — detect to contain to remediate to validate per chain (A, B, C, D, F, G, I, J), with real Snowflake containment SQL (ALTER USER … SET DISABLED, ALTER SHARE … REMOVE ACCOUNTS, RSA_PUBLIC_KEY clearing, PAT revocation), forensic-capture templates.
• attack-chains.html — new "Residual-risk profile" table (Default residual vs. Post-P0 residual per chain).
• detection.html — new chain x maturity-tier coverage matrix; rule counts corrected (34 total: 4 production_ready, 20 requires_enrichment, 4 requires_correlation, 5 requires_cortex_sidecar, 1 requires_endpoint_telemetry).
• cve-inventory.html — every high/medium CVE row now carries Affected / Trigger / Artifact / Detection applicability fields lifted from the per-CVE matrix doc.
• recommendations.html — new 30/60/90/180-day remediation timeline with effort estimates and "why this window" rationale.
• Per-page TOC + anchor IDs on all nine HTML pages (new .page-toc CSS rule, two-column layout).

Detection-rule fixes

• New bulk_exfil_baseline_trail.yml — Chain A's missing Trail pair (the README's "every chain has both ACCOUNT_USAGE and Trail rules" claim was previously overstated for Chain A).
• native_app_privilege_bump.yml, native_app_privilege_bump_trail.yml, native_app_unexpected_version_bump.yml — switched |contains to |startswith to bind to the structural-token contract emitted by application_history projections (PRIVILEGE:<name>, EXTERNAL ACCESS INTEGRATION:<name>, etc.). Mock at infra/lab/mock-snowflake/app.py:1019 confirms the structured-token shape.
• udf_with_eai_invocation.yml — switched to explicit udf_has_eai: true boolean. Previous udf_eai_list|exists: true would pass on an empty list and fire on UDFs that declare no EAIs.
• ENRICHMENT.md section 3 — per-SIEM watermark-computation recipes (Sentinel KQL, Splunk SPL, Elastic) + fallback modes + synthetic-event validation step. Closes the silent-never-fire risk on federated_login_anomaly.yml.

Cross-references

• chain-reference-table.md carries the new Trail rule UUID and the residual-risk profile table.
• detection/snowflake/README.md rule-count tier table reflects the new total (34 / 20).
• All nine report pages share an identical nav block; CI check_snowflake_report_integrity.py passes.

Test plan

• python3 ci/check_snowflake_report_integrity.py — passes (9 pages, nav parity + internal links)
• python3 ci/check_snowflake_tools_syntax.py — passes (24 modules)
• All edited YAML rule files parse as valid YAML
• Open each of the 9 report pages locally (python3 -m http.server 8080 from reports/snowflake-platform-assessment/) and verify: nav highlights the active page, TOC anchors scroll to the right section, all internal links resolve
• Spot-check the new healthcare-overlay.html and incident-response.html for visual consistency with the existing report style
• Re-read the chain-reference table's residual-risk column for any chain where the rationale doesn't match the recommendations page's P0 control

Generated with Claude Code