Databricks Access Token Revoked

AnalysisType: rule
Filename: databricks_access_token_revoked.py
RuleID: "Databricks.Audit.AccessTokenRevoked"
DisplayName: "Databricks Access Token Revoked"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Defense Evasion
Reports:
  MITRE ATT&CK:
    - TA0005:T1070 # Indicator Removal
Severity: Info
Description: >
  Detects revocation of Databricks access tokens. Token revocation may be routine
  credential rotation or could indicate an attacker covering their tracks after
  using a compromised token.
Runbook: |
  1. Verify the token revocation was intentional and authorized
  2. Check if the token was recently created or used from unusual IPs
  3. Look for preceding suspicious activity associated with this token
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/tree/main/base/detections/behavioral
Tests:
  - Name: Token Revoked
    ExpectedResult: true
    Log:
      serviceName: "accounts"
      actionName: "revokeDbToken"
      userIdentity:
        email: "user@example.com"
      requestParams:
        tokenId: "dapi-abc123def456"
      response:
        statusCode: 200

  - Name: Different Service - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "workspace"
      actionName: "revokeDbToken"
      userIdentity:
        email: "user@example.com"

  - Name: Different Action - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "accounts"
      actionName: "generateDbToken"
      userIdentity:
        email: "user@example.com"


# ------ paired body: databricks_access_token_revoked.py ------

from panther_databricks_helpers import databricks_alert_context


def rule(event):
    if event.get("serviceName") != "accounts":
        return False

    return event.get("actionName") == "revokeDbToken"


def title(event):
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    token_id = event.deep_get("requestParams", "tokenId", default="Unknown Token")
    return f"Access token revoked: {token_id} by {actor}"


def dedup(event):
    token_id = event.deep_get("requestParams", "tokenId", default="unknown")
    return f"token_revoked_{token_id}"


def alert_context(event):
    return databricks_alert_context(
        event,
        additional_fields={
            "token_id": event.deep_get("requestParams", "tokenId"),
        },
    )