Detection rules › Panther
Databricks Delta Sharing Recipient Without IP ACLs
Detects creation of Delta Sharing recipients without IP access list restrictions, which could allow unauthorized data access from any location.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562 Impair Defenses |
Rule body yaml
AnalysisType: rule
Filename: databricks_delta_sharing_recipient_without_ip_acls.py
RuleID: "Databricks.Audit.DeltaSharingRecipientWithoutIPACLs"
DisplayName: "Databricks Delta Sharing Recipient Without IP ACLs"
Enabled: true
Status: Experimental
LogTypes:
- Databricks.Audit
Tags:
- Databricks
- Delta Sharing
- Defense Evasion
Reports:
MITRE ATT&CK:
- TA0005:T1562 # Impair Defenses
Severity: Medium
Description: >
Detects creation of Delta Sharing recipients without IP access list restrictions,
which could allow unauthorized data access from any location.
Runbook: |
1. Query audit logs for all Delta Sharing recipient creations in the past 30 days
2. Check if this recipient has accessed shared data in the 24 hours after creation
3. Find all recipients without IP ACLs to establish security posture
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
- Name: Recipient Without IP ACLs
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "deltaSharingControl"
actionName: "createRecipient"
userIdentity:
email: "admin@example.com"
requestParams:
name: "external-partner"
response:
statusCode: 200
- Name: Recipient With Empty String IP ACL
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "deltaSharingControl"
actionName: "createRecipient"
userIdentity:
email: "admin@example.com"
requestParams:
name: "external-partner"
ipAccessList: ""
response:
statusCode: 200
- Name: Recipient With Empty List IP ACL
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "deltaSharingControl"
actionName: "createRecipient"
userIdentity:
email: "admin@example.com"
requestParams:
name: "external-partner"
ipAccessList: []
response:
statusCode: 200
- Name: Recipient With IP ACLs Configured
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "deltaSharingControl"
actionName: "createRecipient"
userIdentity:
email: "admin@example.com"
requestParams:
name: "secure-partner"
ipAccessList: ["203.0.113.0/24", "198.51.100.0/24"]
response:
statusCode: 200
- Name: Different Action Name
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "deltaSharingControl"
actionName: "updateRecipient"
userIdentity:
email: "admin@example.com"
requestParams:
name: "external-partner"
Detection logic
Condition
actionName eq "createRecipient"
requestParams.ipAccessList is_null
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
actionName | eq |
|
requestParams.ipAccessList | is_null |
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
name | requestParams.name |
email | userIdentity.email |