Databricks Data Downloads From Control Plane

AnalysisType: rule
Filename: databricks_data_downloads_from_control_plane.py
RuleID: "Databricks.Audit.DataDownloadsFromControlPlane"
DisplayName: "Databricks Data Downloads From Control Plane"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Exfiltration
Reports:
  MITRE ATT&CK:
    - TA0010:T1567 # Exfiltration Over Web Service
Severity: Medium
Threshold: 21
DedupPeriodMinutes: 60
Description: >
  Detects high volume data downloads from the control plane which may indicate
  data exfiltration. Monitors download actions including query results, notebooks, and models.
Runbook: |
  1. Query audit logs for all download actions by this user in the past 24 hours to calculate total volume
  2. Check if the downloaded data contains sensitive classifications or PII in the 6 hours around this alert
  3. Find all users with high download rates in the past 30 days to establish baseline
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
  - Name: Preview Results Download
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "sql"
      actionName: "downloadPreviewResults"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200

SummaryAttributes:
  - actor


# ------ paired body: databricks_data_downloads_from_control_plane.py ------

from panther_databricks_helpers import DOWNLOAD_ACTIONS, databricks_alert_context


def rule(event):
    action = event.get("actionName")
    if action not in DOWNLOAD_ACTIONS:
        return False

    # Exclude source exports
    if action == "workspaceExport":
        export_format = event.deep_get("requestParams", "workspaceExportFormat")
        if export_format == "SOURCE":
            return False

    # Exclude arrows format
    if action == "downloadQueryResult":
        file_type = event.deep_get("requestParams", "fileType")
        if file_type == "arrows":
            return False

    return True


def dedup(event):
    user = event.deep_get("userIdentity", "email", default="unknown")
    return f"data_download_{user}"


def title(event):
    user = event.deep_get("userIdentity", "email", default="Unknown User")
    action = event.get("actionName", "download")
    return f"High volume data downloads by {user} ({action})"


def alert_context(event):
    return databricks_alert_context(event)