Databricks Verbose Audit Logging Disabled
Description
Detects when verbose audit logging is disabled in a Databricks workspace. Disabling verbose audit logging significantly reduces the visibility of security-relevant events and is a common technique used by attackers to hide malicious activity. Successful disabling is elevated to CRITICAL severity.
Query · python
from panther_databricks_helpers import databricks_alert_context
def rule(event):
if event.get("serviceName") != "workspace":
return False
if event.get("actionName") != "workspaceConfEdit":
return False
# Check if the configuration key is for verbose audit logs
conf_key = event.deep_get("requestParams", "workspaceConfKeys")
if conf_key != "enableVerboseAuditLogs":
return False
# Check if verbose logging is being disabled
conf_value = event.deep_get("requestParams", "workspaceConfValues")
return conf_value == "false"
def severity(event):
status_code = event.deep_get("response", "statusCode")
return "CRITICAL" if status_code == 200 else "HIGH"
def title(event):
actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
status_code = event.deep_get("response", "statusCode")
status = "Successfully disabled" if status_code == 200 else "Attempted to disable"
return f"Verbose audit logging {status} by {actor}"
def alert_context(event):
conf_value = event.deep_get("requestParams", "workspaceConfValues")
return databricks_alert_context(
event,
additional_fields={
"config_key": event.deep_get("requestParams", "workspaceConfKeys"),
"config_value": conf_value,
"config_status": "Disabled" if conf_value == "false" else "Enabled",
},
)
Analyst notes
- Query audit logs for all actions by the actor (userIdentity.email) in the 6 hours before and after disabling audit logging
- Check if there were suspicious data access, deletion, or privilege escalation actions in the 24 hours around this change
- Find all other high-risk configuration changes by this actor in the past 7 days