Databricks Terms of Service Changes

AnalysisType: rule
Filename: databricks_terms_of_service_changes.py
RuleID: "Databricks.Audit.TermsOfServiceChanges"
DisplayName: "Databricks Terms of Service Changes"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Compliance
Severity: Info
Description: >
  Detects Terms of Service acceptance or distribution events for compliance tracking.
  These events should be monitored for audit and governance purposes.
Runbook: |
  1. Query audit logs for all TOS-related events in the past 90 days to establish baseline
  2. Check if this TOS acceptance aligns with expected onboarding or policy update timelines
  3. Find all TOS events for this user to verify compliance history
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
  - Name: TOS Accepted
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "accounts"
      actionName: "acceptTos"
      userIdentity:
        email: "newuser@example.com"
      sourceIPAddress: "198.51.100.1"
      response:
        statusCode: 200
  - Name: TOS Sent
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "accounts"
      actionName: "sendTos"
      userIdentity:
        email: "admin@example.com"
      response:
        statusCode: 200
  - Name: Different Action
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "accounts"
      actionName: "login"
      userIdentity:
        email: "user@example.com"


# ------ paired body: databricks_terms_of_service_changes.py ------

from panther_databricks_helpers import databricks_alert_context


def rule(event):
    return event.get("actionName") in ["acceptTos", "sendTos"]


def title(event):
    action = event.get("actionName", "Unknown Action")
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")

    if action == "acceptTos":
        return f"Terms of Service accepted by {actor}"
    return f"Terms of Service distributed by {actor}"


def alert_context(event):
    return databricks_alert_context(event)