Enhanced Security Monitoring
Enhanced Security Monitoring provides an enhanced disk image and additional security monitoring agents that generate logs that you can review.
Which compute resources get enhanced monitoring
The security enhancements apply only to compute resources in the classic data plane, such as clusters and non-serverless SQL warehouses.
Serverless SQL warehouses do not have extra monitoring when Enhanced Security Monitoring is enabled.
Features and technical controls
Enhanced disk image (a CIS-hardened Ubuntu Advantage AMI)
Antivirus monitoring agent that generate logs that you can review.
File integrity monitoring agent that generate logs that you can review.
Requirements
Your Databricks workspace is on the E2 version of the platform.
Your Databricks workspace is on the Enterprise pricing tier.
Your Databricks account must include the Enhanced Security and Compliance add-on. For details, see the pricing page.
Enable Databricks Enhanced Security Monitoring
Contact your Databricks representative to request that Databricks enable the feature for your workspace.
Wait for confirmation that it is enabled for your workspace.
Restart your compute resources.
Disk image with enhanced hardening
While Databricks Enhanced Security Monitoring is enabled, Databricks compute resources (cluster worker images) in your classic data plane use an enhanced hardened operating system image based on Ubuntu Advantage.
Ubuntu Advantage is a package of enterprise security and support for open source infrastructure and applications that includes the following:
A CIS Level 1 hardened image.
FIPS 140-2 Level 1 validated encryption modules.
Monitoring agents in Databricks compute images
While Databricks Enhanced Security Monitoring is enabled, there are additional security monitoring agents, including two agents that are pre-installed in the images that are used for Databricks compute resource VMs. You cannot disable the monitoring agents that are in the enhanced disk image.
Monitoring agent |
Description |
How to get output |
|---|---|---|
File integrity monitoring |
Monitors for file integrity and security boundary violations. This monitor agent runs on the worker VM in your cluster. |
Enable the audit log system table and review logs for new rows. |
Antivirus and malware detection |
Scans the filesystem for viruses daily. This monitor agent runs on the VMs in your compute resources such as clusters and pro or classic SQL warehouses. The antivirus and malware detection agent scans the entire host OS filesystem and the Databricks Runtime container filesystem. Anything outside the cluster VMs is outside of its scanning scope. |
Enable the audit log system table and review logs for new rows. |
Vulnerability scanning |
Scans the container host (VM) for certain known vulnerabilities and CVEs. The scanning happens in representative images in the Databricks environments. |
Request scan reports on the image from your Databricks representative. |
File integrity monitoring
The data plane image includes a file integrity monitoring service that provides runtime visibility and threat detection for compute resources (cluster workers) in the classic data plane in your account.
The file integrity monitor output is generated within your audit logs, which you can access with system tables (Public Preview). For the JSON schema for new auditable events that are specific to file integrity monitoring, see File integrity monitoring events.
Important
It is your responsibility to review antivirus monitor logs. Databricks may, in its sole discretion, review these logs but does not make a commitment to do so. If the agent detects a malicious activity, it is your responsibility to triage these events and open a support ticket with Databricks if the resolution or remediation requires an action by Databricks. Databricks may take action on the basis of these logs, including suspending or terminating the resources, but does not make any commitment to do so.
Antivirus and malware detection
The enhanced data plane image includes an antivirus engine for detecting trojans, viruses, malware, and other malicious threats. The antivirus monitor scans the entire host OS filesystem and the Databricks Runtime container filesystem. Anything outside the cluster VMs is outside of its scanning scope.
The antivirus monitor output is generated within audit logs, which you can access with system tables (Public Preview). For the JSON schema for new auditable events that are specific to antivirus monitoring, see Antivirus monitoring events.
When a new virtual machine image is built, updated signature files are included within it.
Important
It is your responsibility to review antivirus monitor logs. Databricks may, in its sole discretion, review these logs but does not make a commitment to do so. If the agent detects a malicious activity, it is your responsibility to triage these events and open a support ticket with Databricks if the resolution or remediation requires an action by Databricks. Databricks may take action on the basis of these logs, including suspending or terminating the resources, but does not make any commitment to do so.
When a new AMI image is built, updated signature files are included within the new AMI image.
Vulnerability scanning
A vulnerability monitor agent performs vulnerability scans of the container host (VM) for certain known CVEs.
Important
The scanning happens in representative images in the Databricks environments.
You can request the vulnerability scan reports from your Databricks representative.
When vulnerabilities are found with this agent, Databricks tracks them against its Vulnerability Management SLA and releases an updated image when available. It is your responsibility to restart all compute resources regularly to keep the image up-to-date with the latest image version.
Note
If your workspace is part of the public preview of automatic cluster update, clusters restart only if needed during the scheduled maintenance windows.
Management and upgrade of monitoring agents
The additional monitoring agents that are on the disk images used for the compute resources in the Classic data plane are part of the standard Databricks process for upgrading systems:
The classic data plane base disk image (AMI) is owned, managed, and patched by Databricks.
Databricks delivers and applies security patches by releasing new AMI disk images. The delivery schedule depends on new functionality and the SLA for discovered vulnerabilities. Typical delivery is every two to four weeks.
The base operating system for the data plane is Ubuntu Advantage.
Databricks clusters and pro or classic SQL warehouses are ephemeral by default. Upon launch, clusters and pro or classic SQL warehouses use the latest available base image. Older versions that may have security vulnerabilities are unavailable for new clusters.
You are responsible for restarting clusters (using the UI or API) regularly to ensure they use the latest patched host VM images.
Databricks can, upon request, share a Databricks notebook to identify your workspace’s running clusters and hosts older than a specified number of days and optionally, restart a cluster.
Note
If your workspace is part of the public preview of automatic cluster update, clusters restart only if needed during the scheduled maintenance windows.
Monitor agent termination
If a monitor agent on the worker VM is found to be not running due to crash or other termination, the system will attempt to restart the agent.
Data retention policy for monitor agent data
Monitoring logs are sent to the audit log system table or your own Amazon S3 bucket if you configured audit log delivery. Retention, ingestion, and analysis of these logs is your responsibility.
Vulnerability scanning reports and logs are retained for at least one year by Databricks. You can request the vulnerability reports from your Databricks representative.