Databricks Verbose Audit Logging Disabled


Description

Detects when verbose audit logging is disabled in a Databricks workspace. Disabling verbose audit logging significantly reduces the visibility of security-relevant events and is a common technique used by attackers to hide malicious activity. Successful disabling is elevated to CRITICAL severity.

Query · python

from panther_databricks_helpers import databricks_alert_context


def rule(event):
    if event.get("serviceName") != "workspace":
        return False

    if event.get("actionName") != "workspaceConfEdit":
        return False

    # Check if the configuration key is for verbose audit logs
    conf_key = event.deep_get("requestParams", "workspaceConfKeys")
    if conf_key != "enableVerboseAuditLogs":
        return False

    # Check if verbose logging is being disabled
    conf_value = event.deep_get("requestParams", "workspaceConfValues")
    return conf_value == "false"


def severity(event):
    status_code = event.deep_get("response", "statusCode")
    return "CRITICAL" if status_code == 200 else "HIGH"


def title(event):
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    status_code = event.deep_get("response", "statusCode")
    status = "Successfully disabled" if status_code == 200 else "Attempted to disable"
    return f"Verbose audit logging {status} by {actor}"


def alert_context(event):
    conf_value = event.deep_get("requestParams", "workspaceConfValues")
    return databricks_alert_context(
        event,
        additional_fields={
            "config_key": event.deep_get("requestParams", "workspaceConfKeys"),
            "config_value": conf_value,
            "config_status": "Disabled" if conf_value == "false" else "Enabled",
        },
    )

Analyst notes

  1. Query audit logs for all actions by the actor (userIdentity.email) in the 6 hours before and after disabling audit logging
  2. Check if there were suspicious data access, deletion, or privilege escalation actions in the 24 hours around this change
  3. Find all other high-risk configuration changes by this actor in the past 7 days
Raw source Databricks Verbose Audit Logging Disabled · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified.
AnalysisType: rule
Filename: databricks_verbose_audit_logging_disabled.py
RuleID: "Databricks.Audit.VerboseAuditLoggingDisabled"
DisplayName: "Databricks Verbose Audit Logging Disabled"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Defense Evasion
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.008 # Impair Defenses: Disable or Modify Cloud Logs
Severity: High
Description: >
  Detects when verbose audit logging is disabled in a Databricks workspace. Disabling verbose
  audit logging significantly reduces the visibility of security-relevant events and is a common
  technique used by attackers to hide malicious activity. Successful disabling is elevated to
  CRITICAL severity.
Runbook: |
  1. Query audit logs for all actions by the actor (userIdentity.email) in the 6 hours before and after disabling audit logging
  2. Check if there were suspicious data access, deletion, or privilege escalation actions in the 24 hours around this change
  3. Find all other high-risk configuration changes by this actor in the past 7 days
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/blob/main/base/detections/event-based/verbose_audit_logging_disabled.py
SummaryAttributes:
  - actor
  - source_ip
  - config_status
Tests:
  - Name: Verbose Audit Logging Successfully Disabled
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "workspaceConfEdit"
      userIdentity:
        email: "admin@example.com"
      sourceIPAddress: "198.51.100.1"
      userAgent: "Mozilla/5.0"
      requestParams:
        workspaceConfKeys: "enableVerboseAuditLogs"
        workspaceConfValues: "false"
      response:
        statusCode: 200
      auditLevel: "WORKSPACE_LEVEL"
  - Name: Verbose Audit Logging Disable Attempt Failed
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "workspaceConfEdit"
      userIdentity:
        email: "attacker@example.com"
      sourceIPAddress: "203.0.113.50"
      requestParams:
        workspaceConfKeys: "enableVerboseAuditLogs"
        workspaceConfValues: "false"
      response:
        statusCode: 403
      auditLevel: "WORKSPACE_LEVEL"
  - Name: Verbose Audit Logging Enabled
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "workspaceConfEdit"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        workspaceConfKeys: "enableVerboseAuditLogs"
        workspaceConfValues: "true"
      response:
        statusCode: 200
  - Name: Different Config Key
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "workspaceConfEdit"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        workspaceConfKeys: "someOtherConfig"
        workspaceConfValues: "false"
  - Name: Wrong Service
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "workspaceConfEdit"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        workspaceConfKeys: "enableVerboseAuditLogs"
        workspaceConfValues: "false"


# ------ paired body: databricks_verbose_audit_logging_disabled.py ------

from panther_databricks_helpers import databricks_alert_context


def rule(event):
    if event.get("serviceName") != "workspace":
        return False

    if event.get("actionName") != "workspaceConfEdit":
        return False

    # Check if the configuration key is for verbose audit logs
    conf_key = event.deep_get("requestParams", "workspaceConfKeys")
    if conf_key != "enableVerboseAuditLogs":
        return False

    # Check if verbose logging is being disabled
    conf_value = event.deep_get("requestParams", "workspaceConfValues")
    return conf_value == "false"


def severity(event):
    status_code = event.deep_get("response", "statusCode")
    return "CRITICAL" if status_code == 200 else "HIGH"


def title(event):
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    status_code = event.deep_get("response", "statusCode")
    status = "Successfully disabled" if status_code == 200 else "Attempted to disable"
    return f"Verbose audit logging {status} by {actor}"


def alert_context(event):
    conf_value = event.deep_get("requestParams", "workspaceConfValues")
    return databricks_alert_context(
        event,
        additional_fields={
            "config_key": event.deep_get("requestParams", "workspaceConfKeys"),
            "config_value": conf_value,
            "config_status": "Disabled" if conf_value == "false" else "Enabled",
        },
    )

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.