| name | cis-azure-foundations-2.1.7 |
| description | Ensure diagnostic log delivery is configured for Azure Databricks |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","databricks","analytics"] |
| cis_id | 2.1.7 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure diagnostic log delivery is configured for Azure Databricks
Description
Azure Databricks Diagnostic Logging provides insights into system operations, user activities, and security events within a Databricks workspace. Enabling diagnostic logs helps organizations:
- Detect security threats by logging access, job executions, and cluster activities.
- Ensure compliance with industry regulations such as SOC 2, HIPAA, and GDPR.
- Monitor operational performance and troubleshoot issues proactively.
Rationale
Diagnostic logging provides visibility into security and operational activities within Databricks workspaces while maintaining an audit trail for forensic investigations, and it supports compliance with regulatory standards that require logging and monitoring.
Impact
Logs consume storage and may require additional monitoring tools, leading to increased operational overhead and costs. Incomplete log configurations may result in missing critical events, reducing monitoring effectiveness.
Audit Procedure
Audit from Azure Portal
Check if diagnostic logging is enabled for the Databricks workspace:
- Go to
Azure Databricks.
- Select a workspace.
- In the left-hand menu, select
Monitoring > Diagnostic settings.
- Verify if a diagnostic setting is configured. If not, diagnostic logging is not enabled.
Ensure that logging is enabled for the following categories:
accounts: User account activities.Filesystem: Databricks Filesystem Logs.clusters: Cluster state changes and errors.notebook: Execution events.jobs: Job execution tracking.
Verify that logs are being sent to one or more of the following destinations:
Azure Log Analytics workspace: For analysis and querying.Azure Storage Account: For long-term retention.Azure Event Hubs: For integration with SIEM tools.
Audit from Azure CLI
Check if diagnostic logging is enabled for the Databricks workspace:
az monitor diagnostic-settings list --resource <databricks-resource-id>
If the output is empty, no diagnostic settings are configured.
Verify log categories being collected:
