Databricks User Role Modified

AnalysisType: rule
Filename: databricks_user_role_modified.py
RuleID: "Databricks.Audit.UserRoleModified"
DisplayName: "Databricks User Role Modified"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Privilege Escalation
Reports:
  MITRE ATT&CK:
    - TA0004:T1098 # Account Manipulation
Severity: Info
Description: >
  Detects when user roles are modified or users are added to administrative groups in Databricks.
  This is often legitimate administrative activity but should be monitored for unauthorized changes.
Runbook: |
  1. Query audit logs for all role modifications by the actor (userIdentity.email) in the 24 hours before and after this change
  2. Check if the target user has performed new actions using the modified role in the 6 hours after the change
  3. Find all role modifications for this target user in the past 90 days to establish baseline
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/blob/main/base/detections/event-based/user_role_modified.py
Tests:
  - Name: User Added to Admin Group
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "addUserToAdminGroup"
      userIdentity:
        email: "admin@example.com"
      sourceIPAddress: "198.51.100.1"
      requestParams:
        targetUserName: "user@example.com"
        targetGroupName: "admins"
  - Name: User Role Modified
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "modifyUserRole"
      userIdentity:
        email: "admin@example.com"
      sourceIPAddress: "198.51.100.1"
      requestParams:
        targetUserName: "user@example.com"
        role: "workspace_admin"
  - Name: Different Service
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "addUserToAdminGroup"
      userIdentity:
        email: "admin@example.com"
  - Name: Unrelated Action
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "login"
      userIdentity:
        email: "user@example.com"


# ------ paired body: databricks_user_role_modified.py ------

from panther_databricks_helpers import databricks_alert_context


def rule(event):
    if event.get("serviceName") != "accounts":
        return False

    return event.get("actionName") in ["addUserToAdminGroup", "modifyUserRole"]


def title(event):
    action = event.get("actionName", "Unknown Action")
    actor = event.deep_get("userIdentity", "email", default="Unknown User")
    return f"User role modified: {action} by {actor}"


def alert_context(event):
    return databricks_alert_context(
        event, additional_fields={"request_params": event.get("requestParams")}
    )