Databricks Workspace-Level Configuration Changes

AnalysisType: rule
Filename: databricks_config_changes_workspace_level.py
RuleID: "Databricks.Audit.ConfigChangesWorkspaceLevel"
DisplayName: "Databricks Workspace-Level Configuration Changes"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Persistence
Reports:
  MITRE ATT&CK:
    - TA0003:T1098 # Account Manipulation
Severity: Info
Description: >
  Detects configuration changes at the Databricks workspace level. Workspace-level changes
  affect a single workspace and include settings like cluster configurations, notebook
  settings, and workspace-specific security controls.
Runbook: |
  1. Query audit logs for all workspace configuration changes in the 24 hours around this event
  2. Check if the workspace behavior changed based on cluster activity or user actions in the 6 hours after the configuration change
  3. Find all configuration changes for this workspace in the past 30 days to establish baseline
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/blob/main/base/detections/event-based/configuration_changes_workspace_level.py
Tests:
  - Name: Workspace Config Edit
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "workspace"
      actionName: "workspaceConfEdit"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      sourceIPAddress: "198.51.100.1"
      requestParams:
        workspaceConfKeys: "defaultClusterVersion"
        workspaceConfValues: "12.2.x-scala2.12"
      response:
        statusCode: 200
  - Name: Workspace Settings Updated
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "workspace"
      actionName: "updateWorkspaceSettings"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        setting: "enableNotebookGit"
        value: "true"
      response:
        statusCode: 200
  - Name: Account-Level Change
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      auditLevel: "ACCOUNT_LEVEL"
      serviceName: "accounts"
      actionName: "updateAccountSettings"
      userIdentity:
        email: "admin@example.com"
  - Name: Non-Config Action
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "workspace"
      actionName: "createNotebook"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "user@example.com"


# ------ paired body: databricks_config_changes_workspace_level.py ------

from panther_databricks_helpers import (
    databricks_alert_context,
    get_config_key_value,
    is_config_change,
)


def rule(event):
    # Must be workspace-level audit event
    if event.get("auditLevel") != "WORKSPACE_LEVEL":
        return False

    # Check if it's a workspace configuration change
    return is_config_change(event, config_category="workspace")


def title(event):
    action = event.get("actionName", "Unknown Action")
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    workspace = event.get("workspaceId", "Unknown Workspace")
    status_code = event.deep_get("response", "statusCode")
    status = "Success" if status_code == 200 else "Failed"

    # Include the config key in the title when available
    config_key, _ = get_config_key_value(event)
    if config_key:
        return f"Workspace config change ({config_key}) in {workspace} by {actor} - {status}"

    return f"Workspace configuration change ({action}) in {workspace} by {actor} - {status}"


def dedup(event):
    workspace = event.get("workspaceId", "unknown")
    config_key, _ = get_config_key_value(event)
    return f"workspace_config_change_{workspace}_{config_key}"


def alert_context(event):
    config_key, config_value = get_config_key_value(event)
    return databricks_alert_context(
        event,
        additional_fields={
            "change_scope": "WORKSPACE_LEVEL",
            "config_key": config_key,
            "config_value": config_value,
        },
    )