Filter out common Panther queries for correlation rules and SQL enric…

[ben-githubs]

Background

Customer reported a number of false positives which looked like they were being triggered by legitimate Panther activity. I ran the query in a test instance and noticed some queries from SQL enrichments (being written to stages) and Correlation rules (running EXPLAIN) that were being picked up.

Changes

• Exclude COPYs performed in panher_lookups by PANTHR_READONLY users (with fuzzy match for RBAC users)
• Exclude EXPLAIN operations since those are just readonly

Testing

• Ran the query with my mods and got no hits back

[cursor]

PR Summary

Low Risk
Low risk: changes only tune filtering for a scheduled Snowflake detection query to ignore known benign Panther activity, which may reduce alert coverage if the patterns are too broad.

Overview
Tightens the Query.Snowflake.ConfigurationDrift scheduled query to reduce false positives by excluding EXPLAIN query types and filtering out known benign Panther COPY INTO stage writes performed by PANTHER_READONLY% roles.

This narrows results to better focus on potentially malicious configuration changes while leaving scheduling behavior unchanged.

^{Reviewed by Cursor Bugbot for commit 7018736. Bugbot is set up for automated code reviews on this repo. Configure here.}