Databricks TruffleHog Scan Detected

AnalysisType: rule
Filename: databricks_trufflehog_scan_detected.py
RuleID: "Databricks.Audit.TrufflehogScanDetected"
DisplayName: "Databricks TruffleHog Scan Detected"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Collection
  - Credential Access
Reports:
  MITRE ATT&CK:
    - TA0006:T1552 # Unsecured Credentials
    - TA0009:T1213 # Data from Information Repositories
Severity: Medium
Description: >
  Detects TruffleHog secret scanning activity in Databricks. TruffleHog is a tool used to scan
  repositories and systems for exposed credentials and secrets. While it can be used legitimately
  for security audits, unauthorized scanning may indicate credential harvesting attempts. External
  IP sources are elevated to HIGH severity.
Runbook: |
  1. Query audit logs for all secret access attempts (getSecret action) by this user in the 24 hours before and after the TruffleHog scan
  2. Check if the source IP (sourceIPAddress) matches known security scanning tools or is from an unexpected geographic location
  3. Find all other unusual secret access patterns from this IP or user in the past 7 days
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/blob/main/base/detections/event-based/trufflehog_scan_detected.py
Tests:
  - Name: TruffleHog Scan from External IP
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "login"
      sourceIPAddress: "203.0.113.50"
      userAgent: "TruffleHog/3.0"
      userIdentity:
        email: "scanner@external.com"
      requestParams:
        tokenId: "token-123"
  - Name: TruffleHog Scan from Internal IP
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "listSecrets"
      sourceIPAddress: "10.0.1.100"
      userAgent: "TruffleHog/3.0 (Security Audit)"
      userIdentity:
        email: "security@example.com"
  - Name: Normal User Activity
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "login"
      sourceIPAddress: "198.51.100.1"
      userAgent: "Mozilla/5.0"
      userIdentity:
        email: "user@example.com"
  - Name: Service Agent Activity
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "executeCommand"
      sourceIPAddress: "10.0.1.50"
      userAgent: "Databricks-Runtime/12.0"
      userIdentity:
        email: "system@databricks.com"


# ------ paired body: databricks_trufflehog_scan_detected.py ------

import ipaddress

from panther_databricks_helpers import databricks_alert_context, filter_noise


def rule(event):
    # Filter out system noise
    if filter_noise(event):
        return False

    # Check user agent for TruffleHog signature
    user_agent = event.get("userAgent", "")
    return "TruffleHog" in user_agent


def title(event):
    source_ip = event.get("sourceIPAddress", "Unknown IP")
    user = event.deep_get("userIdentity", "email", default="Unknown User")
    return f"TruffleHog secret scan detected from {source_ip} (User: {user})"


def severity(event):
    source_ip = event.get("sourceIPAddress", "")
    # Lower severity for scans from private IPs (internal testing)
    if source_ip:
        try:
            if ipaddress.ip_address(source_ip).is_private:
                return "MEDIUM"
        except ValueError:
            # Invalid IP format, treat as public (HIGH severity)
            pass
    return "HIGH"


def alert_context(event):
    return databricks_alert_context(
        event,
        additional_fields={
            "token_id": event.deep_get("requestParams", "tokenId"),
            "user_agent_full": event.get("userAgent"),
        },
    )