query_data_lake
Execute custom SQL queries on Panther's data lake for advanced analysis, ensuring Snowflake SQL syntax and p_event_time filtering. Retrieve results, column info, and stats efficiently.
Instructions
Execute custom SQL queries against Panther's data lake for advanced data analysis and aggregation.
All queries MUST conform to Snowflake's SQL syntax.
If the table has a p_event_time column, it must use a WHERE clause to filter upon it.
Guidance:
For efficiency, when checking for values in an array, use the snowflake function ARRAY_CONTAINS( <value_expr> , <array> ).
When using ARRAY_CONTAINS, make sure to cast the value_expr to a variant, for example: ARRAY_CONTAINS('example@example.com'::VARIANT, p_any_emails).
When interacting with object type columns use dot notation to traverse a path in a JSON object:
<column>:<level1_element>.<level2_element>.<level3_element>. Optionally enclose element names in double quotes: <column>:"<level1_element>"."<level2_element>"."<level3_element>".
If an object/JSON element name does not conform to Snowflake SQL identifier rules, for example if it contains spaces, then
you must enclose the element name in double quotes.
Returns: Dict containing: - success: Boolean indicating if the query was successful - status: Status of the query (e.g., "succeeded", "failed", "cancelled") - message: Error message if unsuccessful - query_id: The unique identifier for the query (null if query execution failed) - results: List of query result rows - column_info: Dict containing column names and types - stats: Dict containing stats about the query - has_next_page: Boolean indicating if there are more results available - end_cursor: Cursor for fetching the next page of results, or null if no more pages
Permissions:{'all_of': ['Query Data Lake']}
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| database_name | No | panther_logs.public | |
| sql | Yes | The SQL query to execute. Must include a p_event_time filter condition after WHERE or AND. The query must be compatible with Snowflake SQL. | |
| timeout | No | Timeout in seconds before the SQL query is cancelled. If the query fails due to timeout, the caller should consider a longer timeout. |