Databricks High Priority Configuration Changes

AnalysisType: rule
Filename: databricks_config_changes_high_priority.py
RuleID: "Databricks.Audit.ConfigChangesHighPriority"
DisplayName: "Databricks High Priority Configuration Changes"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Defense Evasion
  - Persistence
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.008 # Impair Defenses: Disable Cloud Logs
    - TA0003:T1098 # Account Manipulation
Severity: Medium
Description: >
  Detects high-priority security configuration changes including audit logging modifications,
  IP access list changes, and security-critical workspace settings. Severity is elevated for
  successful changes to high-risk settings.
Runbook: |
  1. Query audit logs for all configuration changes by the actor in the 24 hours before and after this critical change
  2. Check if this configuration change has been performed by this actor in the past 90 days to establish legitimacy
  3. Find all other high-risk configuration changes (IP access lists, audit settings) across all workspaces in the past 7 days
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/blob/main/base/detections/event-based/configuration_changes_high_priority.py
SummaryAttributes:
  - actor
  - config_key
  - change_category
Tests:
  - Name: Audit Logging Disabled - Handled By Dedicated Rule
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "workspaceConfEdit"
      userIdentity:
        email: "admin@example.com"
      sourceIPAddress: "198.51.100.1"
      requestParams:
        workspaceConfKeys: "enableVerboseAuditLogs"
        workspaceConfValues: "false"
      response:
        statusCode: 200
  - Name: Audit Logging Enabled
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "workspaceConfEdit"
      userIdentity:
        email: "admin@example.com"
      sourceIPAddress: "198.51.100.1"
      requestParams:
        workspaceConfKeys: "enableVerboseAuditLogs"
        workspaceConfValues: "true"
      response:
        statusCode: 200
  - Name: IP Access List Deleted
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "deleteIpAccessList"
      userIdentity:
        email: "admin@example.com"
      sourceIPAddress: "198.51.100.1"
      requestParams:
        listId: "acl-123"
      response:
        statusCode: 200
  - Name: IP Access List Created
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "createIpAccessList"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        ipAddresses: ["10.0.0.0/8"]
      response:
        statusCode: 200
  - Name: MFA Enforcement Changed
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "workspaceConfEdit"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        workspaceConfKeys: "enforceMFA"
        workspaceConfValues: "false"
      response:
        statusCode: 200
  - Name: Non-Critical Config Change
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "workspaceConfEdit"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        workspaceConfKeys: "displayName"
        workspaceConfValues: "Production Workspace"


# ------ paired body: databricks_config_changes_high_priority.py ------

from panther_databricks_helpers import (
    databricks_alert_context,
    get_config_key_value,
    is_critical_config_change,
)


def rule(event):
    if not is_critical_config_change(event):
        return False

    # Verbose audit logging disabled is handled by a dedicated rule
    config_key, config_value = get_config_key_value(event)
    if config_key == "enableVerboseAuditLogs" and config_value == "false":
        return False

    return True


def severity(event):
    status_code = event.deep_get("response", "statusCode")
    success = status_code == 200
    action = event.get("actionName", "Unknown Action")

    # Determine severity from action type
    #                        Success    Failure
    # IP access list deleted HIGH       MEDIUM
    # Other critical configs MEDIUM     LOW
    if action == "deleteIpAccessList":
        return "HIGH" if success else "MEDIUM"
    return "MEDIUM" if success else "LOW"


def title(event):
    action = event.get("actionName", "Unknown Action")
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    status_code = event.deep_get("response", "statusCode")
    status = "Successfully" if status_code == 200 else "Attempted to"

    # IP access list changes
    if "IpAccessList" in action:
        return f"{status} {action} by {actor}"

    # Workspace configuration edits
    config_key, config_value = get_config_key_value(event)
    if config_key:
        return f"{status} modify {config_key} to {config_value} by {actor}"

    return f"Critical configuration change by {actor}"


def dedup(event):
    config_key, _ = get_config_key_value(event)
    # IP access list events don't have workspaceConfKeys, so fall back to actionName
    key = config_key or event.get("actionName", "unknown")
    return f"critical_config_change_{key}"


def alert_context(event):
    config_key, config_value = get_config_key_value(event)
    return databricks_alert_context(
        event,
        additional_fields={
            "config_key": config_key,
            "config_value": config_value,
            "change_category": (
                "IP Access List"
                if "IpAccessList" in event.get("actionName", "")
                else "Workspace Configuration"
            ),
        },
    )