Databricks Delta Sharing IP Access Failures

AnalysisType: rule
Filename: databricks_delta_sharing_ip_access_failures.py
RuleID: "Databricks.Audit.DeltaSharingIPAccessFailures"
DisplayName: "Databricks Delta Sharing IP Access Failures"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Delta Sharing
  - Initial Access
Reports:
  MITRE ATT&CK:
    - TA0001:T1078 # Valid Accounts
Severity: Medium
Description: >
  Detects blocked Delta Sharing access attempts due to IP access list restrictions,
  which may indicate unauthorized access attempts from unexpected locations.
Runbook: |
  1. Query audit logs for all Delta Sharing access attempts from this IP in the past 24 hours
  2. Check if the source IP is associated with known threats or unexpected geographic locations
  3. Find all Delta Sharing access failures in the past 7 days to identify patterns
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
  - Name: IP Access Denied
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingAccess"
      actionName: "getShare"
      sourceIPAddress: "203.0.113.50"
      response:
        statusCode: 403
        errorMessage: "IP address not allowed"
  - Name: Network Not In Allowlist
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingAccess"
      actionName: "getShare"
      sourceIPAddress: "203.0.113.50"
      response:
        statusCode: 403
        errorMessage: "Source network not in allowlist"
  - Name: Non-IP Authorization Failure
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingAccess"
      actionName: "getShare"
      sourceIPAddress: "203.0.113.50"
      response:
        statusCode: 403
        errorMessage: "User does not have permission to access this share"
  - Name: Successful Request
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingAccess"
      actionName: "getShare"
      sourceIPAddress: "198.51.100.1"
      response:
        statusCode: 200
  - Name: Wrong Service
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "unityCatalog"
      actionName: "getShare"
      response:
        statusCode: 403
        errorMessage: "IP address blocked"


# ------ paired body: databricks_delta_sharing_ip_access_failures.py ------

from panther_databricks_helpers import databricks_alert_context

# Keywords that indicate IP-based access denials
IP_DENIAL_KEYWORDS = ["address", "network", "cidr", "allowlist", "blocklist"]


def rule(event):
    if event.get("serviceName") != "deltaSharingAccess":
        return False

    status_code = event.deep_get("response", "statusCode")
    if status_code not in [403, 401]:
        return False

    error_message = event.deep_get("response", "errorMessage", default="").lower()
    return any(keyword in error_message for keyword in IP_DENIAL_KEYWORDS)


def title(event):
    recipient = event.deep_get("requestParams", "recipientName", default="Unknown Recipient")
    source_ip = event.get("sourceIPAddress", "Unknown IP")
    return f"Delta Sharing access blocked from {source_ip} for recipient {recipient}"


def alert_context(event):
    return databricks_alert_context(event)