Versus is the operational system of record for your network, security, and service estate. The Snowflake integration puts that data — devices, ADC objects, tickets, vulnerabilities, alerts, workflow runs, licensing, and audit — in your data cloud, next to everything else, for BI, long-horizon trending, cross-system joins, regulatory retention, and ML. It runs in both directions: export Versus data out, and drive your managed-device inventory in from a Snowflake CMDB.
Four capabilities, each independently toggleable per connection:
Each dataset is a domain you switch on individually. Every row carries a stable canonical schema plus an envelope (tenant_id, change operation, source timestamp, ingest time), so it is decoupled from internal product changes and safe to build reports on.
Pick per connection based on who owns the Snowflake account and how much pipeline you want to run:
| Mode | Who owns the account | How data moves | Best for |
|---|---|---|---|
| A — Customer push | You | Versus writes into your account via an external stage + Snowpipe | Enterprises already on Snowflake |
| B — Managed + Share | Versus | Versus loads its own account; you read via a zero-copy Secure Data Share | Teams who want the data without building a pipeline |
| C — Internal | Versus | Platform-internal analytics | Fleet reporting |
Versus reads changed rows incrementally, maps them to their canonical shape, and writes compact files to an object stage (S3 / R2). Snowflake ingests those files, and native Streams + Tasks shape the raw landing into a clean analytics model (dimensions and facts) — no external orchestrator to run.
Ingestion latency is your choice, per connection or per domain:
Loads are idempotent: a replay of the same file is a no-op, and the incremental cursor only advances after a confirmed load — so a hiccup safely re-sends rather than losing or duplicating data.
Isolation is fail-closed at three layers:
Credentials never live in Versus's database. The Snowflake key or OAuth secret is held in the Versus Vault (envelope-encrypted, hash-chained audit) and resolved at connection time — never logged, never shown in the UI. Access uses least-privilege Snowflake roles, a network policy pinned to Versus egress (or PrivateLink), and storage-integration IAM trust rather than shared cloud keys.
If your authoritative asset/CMDB inventory lives in Snowflake, Versus can onboard and reconcile managed devices from it — the same way it imports from ServiceNow, CI Discovery, or IPAM. You map source columns to device fields, choose match keys (serial, management IP, hostname), and run a dry-run first: Versus shows a per-row plan — create, update (with a field-level diff), conflict (needs a human), or retire — that you review before applying.
Apply is idempotent (re-running an unchanged source changes nothing), every device carries its import provenance, and a device imported from the CMDB can even be bound to a credential from your external vault automatically. Onboarded devices can be soft-retired when they disappear from the source — reversible, never a hard delete.
Reverse-ETL reads from Snowflake for two things: enrichment — pulling designated columns (business owner, criticality, CMDB id, risk score) onto the matching Versus records — and governed query panels that show warehouse-scale trends (for example, a device's 12-month vulnerability history) right in the Versus UI. Enrichment is additive, restricted to an allow-list of fields, tenant-scoped, and audited; it never performs a control-plane action, and queries are a named, parameterised catalog — never raw SQL from the browser.
From Versus Platform → Integrations → Snowflake:
On Versus SaaS, staging uses managed object storage with PrivateLink available, and the managed-account + Secure Share model is offered. On-premises, you connect your own Snowflake and your own storage bucket (Mode A) so data egress stays entirely under your control. The feature is licensed and inert until configured — installing it changes nothing until you create a connection.