Databricks Long-Lifetime Token Generated

AnalysisType: rule
Filename: databricks_long_lifetime_token_generated.py
RuleID: "Databricks.Audit.LongLifetimeTokenGenerated"
DisplayName: "Databricks Long-Lifetime Token Generated"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Credential Access
  - Persistence
Reports:
  MITRE ATT&CK:
    - TA0006:T1550 # Use Alternate Authentication Material
    - TA0003:T1098 # Account Manipulation
Severity: Low
Description: >
  Detects generation of personal access tokens (PATs) with lifetime exceeding 72 hours.
  Long-lived tokens increase the risk of credential theft and unauthorized access if compromised.
  Tokens with lifetime >90 days are elevated to MEDIUM, >1 year to HIGH severity.
Runbook: |
  1. Query audit logs for all token generation by this user in the past 30 days to identify patterns
  2. Check if the generated token has been used for API calls in the 24 hours after creation
  3. Find all other long-lifetime tokens (>72 hours) created in the past 90 days to establish baseline
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
SummaryAttributes:
  - actor
  - token_duration_days
Tests:
  - Name: Token with 7 Day Lifetime
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "accounts"
      actionName: "generateDbToken"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "user@example.com"
      sourceIPAddress: "198.51.100.1"
      requestParams:
        tokenExpirationTime: "1704672000000"
        tokenHash: "abc123def456"
      response:
        statusCode: 200
  - Name: Token with 100 Day Lifetime (MEDIUM)
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "accounts"
      actionName: "generateDbToken"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        tokenExpirationTime: "1712707200000"
        tokenHash: "xyz789"
      response:
        statusCode: 200
  - Name: Token with 24 Hour Lifetime
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "accounts"
      actionName: "generateDbToken"
      userIdentity:
        email: "user@example.com"
      requestParams:
        tokenExpirationTime: "1704153600000"
        tokenHash: "short123"
  - Name: Different Action
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "accounts"
      actionName: "revokeDbToken"
      userIdentity:
        email: "user@example.com"


# ------ paired body: databricks_long_lifetime_token_generated.py ------

from panther_databricks_helpers import databricks_alert_context


def _token_duration_hours(event):
    """Calculate token lifetime in hours, or None if not determinable."""
    try:
        token_expiration = int(event.deep_get("requestParams", "tokenExpirationTime", default=0))
        event_time_ms = event.get("timestamp", 0)
        if not token_expiration or not event_time_ms:
            return None
        return (token_expiration - event_time_ms) / (1000 * 3600)
    except (ValueError, TypeError):
        return None


def rule(event):
    if event.get("actionName") != "generateDbToken":
        return False

    duration = _token_duration_hours(event)
    return duration is not None and duration > 72


def severity(event):
    duration = _token_duration_hours(event)
    if duration is None:
        return "LOW"

    #                    Severity
    # >1 year (8760h)   HIGH
    # >90 days (2160h)  MEDIUM
    # otherwise         LOW
    if duration > 8760:
        return "HIGH"
    if duration > 2160:
        return "MEDIUM"
    return "LOW"


def title(event):
    actor = event.deep_get("userIdentity", "email", default="Unknown User")
    duration = _token_duration_hours(event)
    if duration is not None:
        return f"Long-lifetime token ({int(duration / 24)} days) generated by {actor}"
    return f"Long-lifetime token generated by {actor}"


def alert_context(event):
    duration = _token_duration_hours(event)
    duration_days = duration / 24 if duration is not None else None

    return databricks_alert_context(
        event,
        additional_fields={
            "token_expiration_time": event.deep_get("requestParams", "tokenExpirationTime"),
            "token_hash": event.deep_get("requestParams", "tokenHash"),
            "token_duration_hours": duration,
            "token_duration_days": duration_days,
        },
    )