Databricks detects credential-driven attacks
The story so far
Databricks detects credential-driven attacks by analyzing audit logs and Genie, finding stolen credentials listed from new IPs in secret scopes, directories, and repositories within minutes, then reading secrets containing service principal credentials, and subsequently having the service principal create functions and join admin groups, these non-linear event sequences reveal intrusion behavior.
AI-written from the reports · Updated 3 days ago
Coverage timeline
Follow the coverage to see every side of the story.
- Databricks BlogHow Databricks Detects Credential-Driven Attacks
Databricks detects credential-driven attacks by analyzing audit logs and Genie, finding stolen credentials listed from new IPs in secret scopes, directories, and repositories within minutes, then reading secrets containing service principal credentials, and subsequently having the service principal create functions and join admin groups, these non-linear event sequences reveal intrusion behavior.
Heat over time
- Now
- 3
- Peak
- 1012 Nov, 08:00
- 24h change
- -49%
Hover or tap the chart to see each hour; use the arrow keys on a keyboard.