Issue

When trying to view old alert events in Panther, I encounter error:

Couldn't load events...ErrorMessage=SQL compilation error: Schema 'PANTHER_SIGNALS.PUBLIC' does not exist or not authorized"

How do I resolve this?

Resolution

To resolve this issue:

1. Verify your Snowflake table and view level permissions to check which role is missing.

2. Ensure that your Snowflake roles are granted the necessary SELECT access privileges on both table and view in the PANTHER_SIGNALS database.

Cause

This error typically occurs when SELECT permissions are missing at the table and view level. While the database and schema-level permissions might be correctly set up, table and view-level permissions need to be explicitly granted for proper access to historical alert data. For more information about how future grants behave when defined at both database and schema levels, refer to the Snowflake documentation.

This error occurs when accessing older alerts because they are pulled from the data lake, which can trigger the permissions error for the table. Newer alerts don't exhibit this behaviour as they don't pull from the data lake.