detect-snowflake-replication-config-change

Detect creation or modification of Snowflake account-replication or database-replication configurations to accounts not on the authorized list. Reads OCSF 1.8 API Activity (class 6003) records normalized from `account_usage.query_history` carrying the Snowflake-shaped `unmapped.snowflake.{database_name,target_accounts,operation_kind}` block and emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1537 Transfer Data to Cloud Account whenever `ALTER ACCOUNT SET REPLICATION ENABLED` or `ALTER DATABASE ... ENABLE REPLICATION TO ACCOUNTS (...)` targets an account NOT in `SNOWFLAKE_AUTHORIZED_REPLICATION_TARGETS`. Default allowlist is empty and the detector fails open with a stderr warning when no allowlist is configured. Use when you suspect a compromised credential is setting up exfiltration of an entire database to an attacker-controlled Snowflake account. Do NOT use on raw Snowflake QUERY_HISTORY rows — normalize them through the upstream Snowflake ingest pipeline first. Do NOT use as a generic data-replication detector for non-Snowflake providers.