Snowflake

-- Create user
CREATE USER incidentfox_reader
  PASSWORD = 'secure_password_here'
  DEFAULT_ROLE = INCIDENTFOX_ROLE
  DEFAULT_WAREHOUSE = COMPUTE_WH;

-- Create role with limited permissions
CREATE ROLE INCIDENTFOX_ROLE;

-- Grant read access to relevant schemas
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE INCIDENTFOX_ROLE;
GRANT USAGE ON DATABASE ANALYTICS TO ROLE INCIDENTFOX_ROLE;
GRANT USAGE ON SCHEMA ANALYTICS.OBSERVABILITY TO ROLE INCIDENTFOX_ROLE;
GRANT SELECT ON ALL TABLES IN SCHEMA ANALYTICS.OBSERVABILITY TO ROLE INCIDENTFOX_ROLE;
GRANT SELECT ON FUTURE TABLES IN SCHEMA ANALYTICS.OBSERVABILITY TO ROLE INCIDENTFOX_ROLE;

-- Assign role to user
GRANT ROLE INCIDENTFOX_ROLE TO USER incidentfox_reader;

<account_name>.<region>

{
  "tools": {
    "snowflake": {
      "enabled": true,
      "account": "acme.us-west-2",
      "username": "vault://secrets/snowflake-user",
      "password": "vault://secrets/snowflake-pass",
      "warehouse": "COMPUTE_WH",
      "database": "ANALYTICS",
      "schema": "OBSERVABILITY",
      "role": "INCIDENTFOX_ROLE"
    }
  }
}

@incidentfox query snowflake for error counts by service in the last 7 days

@incidentfox show the schema for the error_logs table in snowflake

SELECT
  service_name,
  error_type,
  COUNT(*) as error_count,
  DATE_TRUNC('hour', timestamp) as hour
FROM analytics.observability.error_logs
WHERE timestamp > DATEADD('day', -7, CURRENT_TIMESTAMP())
GROUP BY service_name, error_type, hour
ORDER BY hour DESC, error_count DESC
LIMIT 100

SELECT
  customer_tier,
  COUNT(DISTINCT customer_id) as affected_customers,
  SUM(transaction_value) as affected_revenue
FROM analytics.business.transactions t
JOIN analytics.business.customers c ON t.customer_id = c.id
WHERE t.service = 'payments'
  AND t.status = 'failed'
  AND t.timestamp > DATEADD('hour', -1, CURRENT_TIMESTAMP())
GROUP BY customer_tier

SELECT
  d.service,
  d.version,
  d.deployed_at,
  COUNT(e.id) as errors_after_deploy
FROM analytics.devops.deployments d
LEFT JOIN analytics.observability.errors e
  ON e.service = d.service
  AND e.timestamp BETWEEN d.deployed_at AND DATEADD('hour', 4, d.deployed_at)
WHERE d.deployed_at > DATEADD('day', -1, CURRENT_TIMESTAMP())
GROUP BY d.service, d.version, d.deployed_at
ORDER BY d.deployed_at DESC

User: @incidentfox investigate high error rate in checkout

IncidentFox:
1. Queries Coralogix for current errors
2. Queries Snowflake for historical error baseline
3. Queries Snowflake for recent deployments
4. Correlates findings

Result: "Error rate is 10x normal baseline. This matches a pattern
seen after v2.3.1 deployment last month. Current deployment v2.5.0
went out 45 minutes ago. Recommend rollback."

CREATE TABLE analytics.observability.error_summary (
  timestamp TIMESTAMP,
  service VARCHAR,
  error_type VARCHAR,
  error_count INTEGER,
  affected_users INTEGER,
  PRIMARY KEY (timestamp, service, error_type)
);

CREATE TABLE analytics.devops.deployments (
  id VARCHAR PRIMARY KEY,
  service VARCHAR,
  version VARCHAR,
  deployed_at TIMESTAMP,
  deployed_by VARCHAR,
  commit_sha VARCHAR,
  rollback_of VARCHAR
);

CREATE TABLE analytics.metadata.services (
  name VARCHAR PRIMARY KEY,
  team VARCHAR,
  criticality VARCHAR,  -- P0, P1, P2, P3
  oncall_group VARCHAR,
  documentation_url VARCHAR,
  dependencies ARRAY
);

{
  "tools": {
    "snowflake": {
      "query_timeout": 30,
      "max_rows": 10000,
      "cost_limit": 1.0
    }
  }
}