Detection rules › Panther
Databricks Delta Sharing IP Access Failures
Detects blocked Delta Sharing access attempts due to IP access list restrictions, which may indicate unauthorized access attempts from unexpected locations.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts |
Rule body yaml
AnalysisType: rule
Filename: databricks_delta_sharing_ip_access_failures.py
RuleID: "Databricks.Audit.DeltaSharingIPAccessFailures"
DisplayName: "Databricks Delta Sharing IP Access Failures"
Enabled: true
Status: Experimental
LogTypes:
- Databricks.Audit
Tags:
- Databricks
- Delta Sharing
- Initial Access
Reports:
MITRE ATT&CK:
- TA0001:T1078 # Valid Accounts
Severity: Medium
Description: >
Detects blocked Delta Sharing access attempts due to IP access list restrictions,
which may indicate unauthorized access attempts from unexpected locations.
Runbook: |
1. Query audit logs for all Delta Sharing access attempts from this IP in the past 24 hours
2. Check if the source IP is associated with known threats or unexpected geographic locations
3. Find all Delta Sharing access failures in the past 7 days to identify patterns
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
- Name: IP Access Denied
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "deltaSharingAccess"
actionName: "getShare"
sourceIPAddress: "203.0.113.50"
response:
statusCode: 403
errorMessage: "IP address not allowed"
- Name: Network Not In Allowlist
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "deltaSharingAccess"
actionName: "getShare"
sourceIPAddress: "203.0.113.50"
response:
statusCode: 403
errorMessage: "Source network not in allowlist"
- Name: Non-IP Authorization Failure
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "deltaSharingAccess"
actionName: "getShare"
sourceIPAddress: "203.0.113.50"
response:
statusCode: 403
errorMessage: "User does not have permission to access this share"
- Name: Successful Request
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "deltaSharingAccess"
actionName: "getShare"
sourceIPAddress: "198.51.100.1"
response:
statusCode: 200
- Name: Wrong Service
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "unityCatalog"
actionName: "getShare"
response:
statusCode: 403
errorMessage: "IP address blocked"
Detection logic
Condition
serviceName eq "deltaSharingAccess"
response.statusCode in ["403", "401"]
response.errorMessage contains "address" or response.errorMessage contains "network" or response.errorMessage contains "cidr" or response.errorMessage contains "allowlist" or response.errorMessage contains "blocklist"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
response.errorMessage | contains |
|
response.statusCode | in |
|
serviceName | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
sourceIPAddress | |
recipientName | requestParams.recipientName |