Databricks Non-SSO Login Detected

AnalysisType: rule
Filename: databricks_non_sso_login.py
RuleID: "Databricks.Audit.NonSSOLogin"
DisplayName: "Databricks Non-SSO Login Detected"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Initial Access
Reports:
  MITRE ATT&CK:
    - TA0001:T1078 # Valid Accounts
Severity: Info
Description: >
  Detects successful logins that bypass SSO (SAML). In organizations that enforce SSO,
  non-SAML logins may indicate credential compromise, misconfigured service accounts,
  or unauthorized access methods.
Runbook: |
  1. Verify whether the user is expected to use non-SSO authentication
  2. Check if this is a service account or automation that legitimately bypasses SSO
  3. Review the authentication_method in alert context
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/tree/main/base/detections/behavioral
Tests:
  - Name: Non-SSO Login - Token Auth
    ExpectedResult: true
    Log:
      serviceName: "accounts"
      actionName: "tokenLogin"
      userIdentity:
        email: "user@example.com"
      requestParams:
        authentication_method: "TOKEN"
      response:
        statusCode: 200

  - Name: SSO Login - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "accounts"
      actionName: "samlLogin"
      userIdentity:
        email: "user@example.com"
      requestParams:
        authentication_method: "BROWSER_BYO_IDP_SAML"
      response:
        statusCode: 200

  - Name: Failed Login - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "accounts"
      actionName: "tokenLogin"
      userIdentity:
        email: "user@example.com"
      requestParams:
        authentication_method: "TOKEN"
      response:
        statusCode: 401

  - Name: No Auth Method - Non-SAML Action Should Alert
    ExpectedResult: true
    Log:
      serviceName: "accounts"
      actionName: "tokenLogin"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200
  - Name: No Auth Method - SAML Action Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "accounts"
      actionName: "samlLogin"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200

  - Name: Non-Login Action - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "accounts"
      actionName: "createUser"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        authentication_method: "TOKEN"
      response:
        statusCode: 200


# ------ paired body: databricks_non_sso_login.py ------

from panther_databricks_helpers import databricks_alert_context, is_login_action


def rule(event):
    if not is_login_action(event):
        return False

    if event.deep_get("response", "statusCode") != 200:
        return False

    # Alert on logins that bypass SSO (SAML).
    # If authentication_method is missing, fall back to checking the action name.
    auth_method = event.deep_get("requestParams", "authentication_method", default="")
    if auth_method:
        return auth_method != "BROWSER_BYO_IDP_SAML"

    # No auth_method field: treat non-SAML login actions as non-SSO
    return event.get("actionName") not in ("samlLogin",)


def title(event):
    user = event.deep_get("userIdentity", "email", default="Unknown User")
    auth_method = event.deep_get("requestParams", "authentication_method", default="Unknown")
    action = event.get("actionName", "login")
    return f"Non-SSO login by {user} via {auth_method} ({action})"


def dedup(event):
    user = event.deep_get("userIdentity", "email", default="unknown")
    return f"non_sso_login_{user}"


def alert_context(event):
    return databricks_alert_context(
        event,
        additional_fields={
            "authentication_method": event.deep_get("requestParams", "authentication_method"),
        },
    )