Databricks TruffleHog Scan Detected

AnalysisType: rule
Filename: databricks_trufflehog_scan_detected.py
RuleID: "Databricks.Audit.TrufflehogScanDetected"
DisplayName: "Databricks TruffleHog Scan Detected"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Collection
  - Credential Access
Reports:
  MITRE ATT&CK:
    - TA0006:T1552 # Unsecured Credentials
    - TA0009:T1213 # Data from Information Repositories
Severity: Medium
Description: >
  Detects TruffleHog secret scanning activity in Databricks. TruffleHog is a tool used to scan
  repositories and systems for exposed credentials and secrets. While it can be used legitimately
  for security audits, unauthorized scanning may indicate credential harvesting attempts. External
  IP sources are elevated to HIGH severity.
Runbook: |
  1. Query audit logs for all secret access attempts (getSecret action) by this user in the 24 hours before and after the TruffleHog scan
  2. Check if the source IP (sourceIPAddress) matches known security scanning tools or is from an unexpected geographic location
  3. Find all other unusual secret access patterns from this IP or user in the past 7 days
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/blob/main/base/detections/event-based/trufflehog_scan_detected.py
Tests:
  - Name: TruffleHog Scan from External IP
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "login"
      sourceIPAddress: "203.0.113.50"
      userAgent: "TruffleHog/3.0"
      userIdentity:
        email: "scanner@external.com"
      requestParams:
        tokenId: "token-123"
  - Name: TruffleHog Scan from Internal IP
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "listSecrets"
      sourceIPAddress: "10.0.1.100"
      userAgent: "TruffleHog/3.0 (Security Audit)"
      userIdentity:
        email: "security@example.com"
  - Name: Normal User Activity
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "accounts"
      actionName: "login"
      sourceIPAddress: "198.51.100.1"
      userAgent: "Mozilla/5.0"
      userIdentity:
        email: "user@example.com"
  - Name: Service Agent Activity
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      serviceName: "workspace"
      actionName: "executeCommand"
      sourceIPAddress: "10.0.1.50"
      userAgent: "Databricks-Runtime/12.0"
      userIdentity:
        email: "system@databricks.com"