Databricks Group Created

AnalysisType: rule
Filename: databricks_group_created.py
RuleID: "Databricks.Audit.GroupCreated"
DisplayName: "Databricks Group Created"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Persistence
Reports:
  MITRE ATT&CK:
    - TA0003:T1136 # Create Account
Severity: Info
Description: >
  Detects creation of user groups in Databricks. Group creation may be part of normal
  administration or could indicate privilege escalation preparation by creating a group
  that will later receive elevated permissions.
Runbook: |
  1. Verify the group creation was part of an approved workflow
  2. Check if the group was subsequently granted admin or elevated permissions
  3. Review group membership additions following creation
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/tree/main/base/detections/behavioral
Tests:
  - Name: Group Created
    ExpectedResult: true
    Log:
      serviceName: "accounts"
      actionName: "createGroup"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        targetGroupName: "data-engineers"
      response:
        statusCode: 200

  - Name: Different Service - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "workspace"
      actionName: "createGroup"
      userIdentity:
        email: "admin@example.com"

  - Name: Different Action - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "accounts"
      actionName: "removeGroup"
      userIdentity:
        email: "admin@example.com"


# ------ paired body: databricks_group_created.py ------

from panther_databricks_helpers import databricks_alert_context, extract_group_identifier


def rule(event):
    if event.get("serviceName") != "accounts":
        return False

    return event.get("actionName") == "createGroup"


def title(event):
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    group = extract_group_identifier(event) or event.deep_get(
        "requestParams", "groupName", default="Unknown Group"
    )
    return f"Group created: {group} by {actor}"


def dedup(event):
    group = extract_group_identifier(event) or "unknown"
    return f"group_created_{group}"


def alert_context(event):
    return databricks_alert_context(
        event,
        additional_fields={
            "group_name": extract_group_identifier(event),
        },
    )