Databricks User Password Changed

AnalysisType: rule
Filename: databricks_user_password_changed.py
RuleID: "Databricks.Audit.UserPasswordChanged"
DisplayName: "Databricks User Password Changed"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Credential Access
Reports:
  MITRE ATT&CK:
    - TA0006:T1098 # Account Manipulation
Severity: Info
Description: >
  Detects password change events on Databricks accounts. May indicate legitimate
  password rotation or an unauthorized reset following account compromise.
Runbook: |
  1. Verify the password change was initiated by the legitimate account owner
  2. Check for preceding suspicious activity (failed logins, MFA changes)
  3. If unauthorized, force password reset and revoke active sessions
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/tree/main/base/detections/behavioral
Tests:
  - Name: Password Changed Successfully
    ExpectedResult: true
    Log:
      serviceName: "accounts"
      actionName: "changePassword"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200

  - Name: Password Change Failed
    ExpectedResult: true
    Log:
      serviceName: "accounts"
      actionName: "changePassword"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 403

  - Name: Different Service - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "workspace"
      actionName: "changePassword"
      userIdentity:
        email: "user@example.com"

  - Name: Different Action - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "accounts"
      actionName: "login"
      userIdentity:
        email: "user@example.com"


# ------ paired body: databricks_user_password_changed.py ------

from panther_databricks_helpers import databricks_alert_context


def rule(event):
    if event.get("serviceName") != "accounts":
        return False

    return event.get("actionName") == "changePassword"


def title(event):
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    status_code = event.deep_get("response", "statusCode")
    status = "Success" if status_code == 200 else "Failed"
    return f"Password changed by {actor} - {status}"


def dedup(event):
    actor = event.deep_get("userIdentity", "email", default="unknown")
    return f"password_changed_{actor}"


def alert_context(event):
    return databricks_alert_context(event)