Strac connector reference

Important

This feature is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage Azure Databricks previews.

This page has reference information for the managed Strac connector, including the supported source table and its destination table schema.

Supported source tables

The Strac connector supports a single source table, audit_events, under the default source schema. The table supports incremental ingestion. The connector uses the dateTime field as the cursor field for incremental ingestion.

Source table	Primary key	Description	Sync mode	Cursor field
audit_events	eventId	Data-security audit events from Strac, such as user actions and access activity.	Incremental	dateTime

Destination table schemas

audit_events

Field	Data type	Description
eventId	STRING	Primary key. Event identifier.
dateTime	TIMESTAMP	Event timestamp. The incremental cursor field.
actorEmailAddress	STRING	Email of the user who performed the action.
actorIpAddress	STRING	Source IP address of the actor.
actorUserAgent	STRING	User agent string of the actor.
actorUserGroups	ARRAY<STRING>	Groups the actor belongs to.
actionName	STRING	Name of the action performed.
actionDescription	STRING	Human-readable description of the action.
actionRequestPath	STRING	API request path of the action.
target	STRING	JSON string describing the action target and parameters.

Pagination and incremental ingestion

The connector reads from the Strac GET /data-security/audit-event endpoint on your API host. It applies server-side date filtering with startDate and endDate query parameters and pages through results using an opaque nextCursor cursor, with a page size of 1000.

For incremental ingestion, the connector tracks the dateTime field as the cursor. When no start datetime is configured, the connector backfills the last 365 days. See Strac connector limitations.

Connector options

The Strac connector has no configurable connector options.