cis-azure-foundations-2-1-7

name	cis-azure-foundations-2.1.7
description	Ensure diagnostic log delivery is configured for Azure Databricks
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","databricks","analytics"]
cis_id	2.1.7
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure diagnostic log delivery is configured for Azure Databricks

Description

Azure Databricks Diagnostic Logging provides insights into system operations, user activities, and security events within a Databricks workspace. Enabling diagnostic logs helps organizations:

• Detect security threats by logging access, job executions, and cluster activities.
• Ensure compliance with industry regulations such as SOC 2, HIPAA, and GDPR.
• Monitor operational performance and troubleshoot issues proactively.

Rationale

Diagnostic logging provides visibility into security and operational activities within Databricks workspaces while maintaining an audit trail for forensic investigations, and it supports compliance with regulatory standards that require logging and monitoring.

Impact

Logs consume storage and may require additional monitoring tools, leading to increased operational overhead and costs. Incomplete log configurations may result in missing critical events, reducing monitoring effectiveness.

Audit Procedure

Audit from Azure Portal

Check if diagnostic logging is enabled for the Databricks workspace:

1. Go to Azure Databricks.
2. Select a workspace.
3. In the left-hand menu, select Monitoring > Diagnostic settings.
4. Verify if a diagnostic setting is configured. If not, diagnostic logging is not enabled.

Ensure that logging is enabled for the following categories:

• accounts: User account activities.
• Filesystem: Databricks Filesystem Logs.
• clusters: Cluster state changes and errors.
• notebook: Execution events.
• jobs: Job execution tracking.

Verify that logs are being sent to one or more of the following destinations:

• Azure Log Analytics workspace: For analysis and querying.
• Azure Storage Account: For long-term retention.
• Azure Event Hubs: For integration with SIEM tools.

Audit from Azure CLI

Check if diagnostic logging is enabled for the Databricks workspace:

az monitor diagnostic-settings list --resource <databricks-resource-id>

If the output is empty, no diagnostic settings are configured.

Verify log categories being collected: