Databricks Delta Sharing Recipient Without IP ACLs

AnalysisType: rule
Filename: databricks_delta_sharing_recipient_without_ip_acls.py
RuleID: "Databricks.Audit.DeltaSharingRecipientWithoutIPACLs"
DisplayName: "Databricks Delta Sharing Recipient Without IP ACLs"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Delta Sharing
  - Defense Evasion
Reports:
  MITRE ATT&CK:
    - TA0005:T1562 # Impair Defenses
Severity: Medium
Description: >
  Detects creation of Delta Sharing recipients without IP access list restrictions,
  which could allow unauthorized data access from any location.
Runbook: |
  1. Query audit logs for all Delta Sharing recipient creations in the past 30 days
  2. Check if this recipient has accessed shared data in the 24 hours after creation
  3. Find all recipients without IP ACLs to establish security posture
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
  - Name: Recipient Without IP ACLs
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "createRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "external-partner"
      response:
        statusCode: 200
  - Name: Recipient With Empty String IP ACL
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "createRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "external-partner"
        ipAccessList: ""
      response:
        statusCode: 200
  - Name: Recipient With Empty List IP ACL
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "createRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "external-partner"
        ipAccessList: []
      response:
        statusCode: 200
  - Name: Recipient With IP ACLs Configured
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "createRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "secure-partner"
        ipAccessList: ["203.0.113.0/24", "198.51.100.0/24"]
      response:
        statusCode: 200
  - Name: Different Action Name
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "updateRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "external-partner"


# ------ paired body: databricks_delta_sharing_recipient_without_ip_acls.py ------

from panther_databricks_helpers import databricks_alert_context


def rule(event):
    if event.get("actionName") != "createRecipient":
        return False

    # Check if IP access list is configured
    # Alert if IP ACL is missing, empty string, or empty list (all falsy)
    ip_access_list = event.deep_get("requestParams", "ipAccessList")
    return not ip_access_list


def title(event):
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    recipient = event.deep_get("requestParams", "name", default="Unknown Recipient")
    return f"Delta Sharing recipient created without IP ACLs: {recipient} by {actor}"


def alert_context(event):
    return databricks_alert_context(
        event,
        additional_fields={"recipient_name": event.deep_get("requestParams", "name")},
    )