Find forbidden IP's on Snowflake

find_forbidden_ips.sql

SELECT *
  FROM TABLE(rest_event_history(
        'scim',
        DATEADD('minutes',-3600,CURRENT_TIMESTAMP()),
        CURRENT_TIMESTAMP(),
        200))
 WHERE details like '%FORBIDDEN%'
   AND DATE_TRUNC('DAY', event_timestamp) = '2022-08-10'
ORDER BY event_timestamp DESC;