Diagnostic log reference

Note

This feature requires the Premium plan.

This article provides you with a comprehensive reference of audit log services and events. The availability of these services depends on how you access the logs:

  • The audit log system table records all events and services listed in this article.
  • Azure Monitor's diagnostic settings service does not log all of these services. Services that are unavailable on Azure's diagnostic settings are labeled accordingly.
  • The workspace-level and account-level designations only apply to the audit logs system table. Azure diagnostic logs do not include account-level events.

Note

Azure Databricks retains a copy of audit logs for up to 1 year for security and fraud analysis purposes.

Workspace-level events

The following services log audit events at the workspace level.

Authentication events

These events are related to user authentication.

These events are logged under the service_name of accounts.

action_name Description request_params
accountInHouseOAuthClientAuthentication An OAuth client is authenticated using an in-house OAuth token.
  • user
  • authenticationMethod
accountLoginCodeAuthentication A user's account login code is authenticated.
  • user
aadBrowserLogin A user logs in to Databricks using a Microsoft Entra ID browser workflow.
  • user
aadTokenLogin A user logs in to Databricks through the Microsoft Entra ID token.
  • user
jwtLogin User logs into Databricks using a JWT.
  • user
  • authenticationMethod
login User logs into the workspace.
  • user
  • authenticationMethod
logout User logs out of the workspace.
  • user
mfaAddKey User registers a new security key.
mfaDeleteKey User deletes a security key.
  • id
mfaLogin User logs into Databricks using MFA.
  • user
  • authenticationMethod
mintOAuthAuthorizationCode An in-house OAuth authorization code is minted.
  • client_id
mintOAuthToken An in-house OAuth token is minted.
  • grant_type
  • scope
  • expires_in
  • client_id
multiFactorAuthenticationLogin A user logs in to Databricks using multi-factor authentication.
  • user
  • authenticationMethod
oidcBrowserLogin A user logs in to Databricks using an OpenID Connect browser workflow.
  • user
  • authenticationMethod
oidcTokenAuthorization When an API call is authorized through a generic OIDC/OAuth token.
  • user
  • authenticationMethod
samlLogin User logs in to Databricks through SAML SSO.
  • user
  • authenticationMethod
tokenLogin A user logs into Databricks using a token.
  • tokenId
  • user
  • authenticationMethod
workspaceLoginCodeAuthentication A user's workspace-scoped login code is authenticated.
  • user
  • authenticationMethod

User and group management events

These events are related to user and group management.

These events are logged under the service_name of accounts.

action_name Description request_params
activateUser A user is reactivated after being deactivated. See Deactivate users in workspace.
  • targetUserName
  • endpoint
  • targetUserId
add A user is added to a Azure Databricks workspace.
  • targetUserName
  • endpoint
  • targetUserId
addPrincipalToGroup A user is added to a workspace-level group.
  • targetGroupId
  • endpoint
  • targetUserId
  • targetGroupName
  • groupMembershipType
  • targetUserName
addPrincipalsToGroup Multiple users are added to a workspace-level group.
  • targetGroupId
  • endpoint
  • targetUserId
  • targetGroupName
  • groupMembershipType
  • targetUserName
changeDatabricksSqlAcl A user's Databricks SQL permissions are changed.
  • shardName
  • targetUserId
  • resourceId
  • aclPermissionSet
changeDatabricksWorkspaceAcl Permissions to a workspace are changed.
  • shardName
  • targetUserId
  • resourceId
  • aclPermissionSet
changeDatabricksWorkspaceDirectoryAcl Permissions to a workspace directory are changed.
  • shardName
  • targetUserId
  • resourceId
  • aclPermissionSet
changePassword A user's password is changed.
  • newPasswordSource
  • targetUserId
  • serviceSource
  • wasPasswordChanged
  • userId
changePasswordAcl Password changing permissions are changed in the account.
  • shardName
  • targetUserId
  • resourceId
  • aclPermissionSet
changeServicePrincipalAcls When a service principal's permissions are changed.
  • shardName
  • targetServicePrincipal
  • resourceId
  • aclPermissionSet
createGroup A workspace-level group is created.
  • endpoint
  • targetUserId
  • targetUserName
deactivateUser A user is deactivated in the workspace. See Deactivate users in workspace.
  • targetUserName
  • endpoint
  • targetUserId
delete A user is deleted from the Azure Databricks workspace.
  • targetUserId
  • targetUserName
  • endpoint
deleteUser A user's personally identifiable information is purged after they have not belonged to any running workspaces for at least 7 days.
disableClusterAcls Cluster access control is disabled for the workspace.
  • shardName
  • endpoint
disableTableAcls Table access control is disabled for the workspace.
  • shardName
  • endpoint
disableWorkspaceAcls Workspace access control is disabled for the workspace.
  • shardName
  • endpoint
enableClusterAcls Cluster access control is enabled for the workspace.
  • shardName
  • endpoint
enableTableAcls Table access control is enabled for the workspace.
  • shardName
  • endpoint
enableWorkspaceAcls Workspace access control is enabled for the workspace.
  • shardName
  • endpoint
removeAdmin A user is revoked of workspace admin permissions.
  • targetUserName
  • endpoint
  • targetUserId
removeGroup A group is removed from the workspace.
  • targetGroupId
  • targetGroupName
  • endpoint
removePrincipalFromGroup A user is removed from a group.
  • targetGroupId
  • endpoint
  • targetUserId
  • targetGroupName
  • groupMembershipType
  • targetUserName
removePrincipalsFromGroup Multiple users are removed from a workspace-level group.
  • targetGroupId
  • endpoint
  • targetUserId
  • targetGroupName
  • groupMembershipType
  • targetUserName
resetPassword A user's password is reset.
  • serviceSource
  • userId
  • endpoint
  • targetUserId
  • targetUserName
  • wasPasswordChanged
  • newPasswordSource
setAdmin A user is granted account admin permissions.
  • endpoint
  • targetUserName
  • targetUserId
updateGroup A group's properties are updated.
  • endpoint
  • targetGroupId
  • targetGroupName
updateUser A change is made to a user's account.
  • endpoint
  • targetUserName
  • targetUserId
  • targetUserExternalId
usernameDomainDenied A user sign-up attempt is denied because the email domain is not allowed.
  • targetUserName
validateEmail When a user validates their email after account creation.
  • endpoint
  • targetUserName
  • targetUserId

Token management events

These events are related to token management.

These events are logged under the service_name of accounts.

action_name Description request_params
autoScopeDbToken A batch operation reduces token scopes as part of automated scope enforcement.
  • token_infos.scope
  • token_infos.token_hash
  • token_partition_id.workspaceId
  • token_partition_id.accountId
  • run_mode
changeDbTokenAcl Permissions on an access token are changed.
  • shardName
  • targetUserId
  • resourceId
  • aclPermissionSet
changeDbTokenState A Databricks access token is disabled.
  • tokenHash
  • tokenState
  • userId
garbageCollectDbToken A user runs a garbage collect command on expired tokens.
  • tokenExpirationTime
  • tokenClientId
  • userId
  • tokenCreationTime
  • tokenFirstAccessed
  • tokenHash
generateDbToken When someone generates a token from User Settings or when the service generates the token.
  • tokenExpirationTime
  • tokenCreatedBy
  • tokenHash
  • userId
reachMaxQuotaDbToken When the current number of non-expired tokens exceeds the token quota.
revokeDbToken A user's token is dropped from a workspace. Can be triggered by a user being removed from the Databricks account.
  • userId
  • tokenHash
revokeOutOfQuotaDbToken A Databricks access token is revoked because the token quota was exceeded.
updateDbToken A Databricks access token is updated.
  • token.scopes
  • token_id
updateOnBehalfOfToken An on-behalf-of token is updated.
  • token.created_by_id
  • token.owner_id
  • token.scopes
  • token.token_id

IP access list events

These events are related to IP access lists.

These events are logged under the service_name of accounts.

action_name Description request_params
createIpAccessList An IP access list is added to the workspace.
  • ipAccessListId
  • userId
deleteIpAccessList An IP access list is deleted from the workspace.
  • ipAccessListId
  • userId
IpAccessDenied A user attempts to connect to the service through a denied IP.
  • path
  • user
  • userId
ipAccessListQuotaExceeded
  • userId
updateIpAccessList An IP access list is changed.
  • ipAccessListId
  • userId

Groups events

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

These events are logged at the workspace level. This service includes events related to account and workspace groups. These actions are related to legacy ACL groups. For actions related to account- and workspace-level groups, see Authentication events and Account-level authentication events.

These events are logged under the service_name of groups.

action_name Description request_params
addPrincipalToGroup An admin adds a user to a group.
  • user_name
  • parent_name
createGroup An admin creates a group.
  • group_name
getGroupMembers An admin views group members.
  • group_name
getGroups An admin views a list of groups none
getInheritedGroups An admin views inherited groups none
removeGroup An admin removes a group.
  • group_name

IAM role events

The following event is logged at the workspace level.

These events are logged under the service_name of iamRole.

action_name Description request_params
changeIamRoleAcl A workspace admin changes permissions for an IAM role.
  • targetUserId
  • shardName
  • resourceId
  • aclPermissionSet

AI/BI dashboard events

These events are logged at the workspace level. This service includes events related to AI/BI dashboards.

These events are logged under the service_name of dashboards.

action_name Description request_params
getDashboard A user accesses the draft version of a dashboard either by viewing it in the UI or requesting the dashboard definition using the API. Only workspace users can access the draft version of a dashboard.
  • dashboard_id
getPublishedDashboard A user accesses the published version of a dashboard by viewing in the UI or requesting the dashboard definition using the API. Includes activity from both workspace users and account users. Excludes receiving a PDF snapshot of a dashboard using scheduled email.
  • dashboard_id
  • credentials_embedded
executeQuery A user executes a query from a dashboard.
  • dashboard_id
  • statement_id
  • details
cancelQuery A user cancels a query from a dashboard.
  • dashboard_id
  • statement_id
getQueryResult A user receives the results of a query from a dashboard.
  • dashboard_id
  • statement_id
triggerDashboardSnapshot A user downloads a PDF snapshot of a dashboard.
  • dashboard_id
  • name
sendDashboardSnapshot A PDF snapshot of a dashboard is sent through a scheduled email or notification destination.
The request parameters values depend on the type of recipient. For a Databricks notification destination, only the destination_id is shown. For a Databricks user, the subscriber's user ID and email address are shown. If the recipient is an email address, only the email address is shown.
  • dashboard_id
  • subscriber_destination_id
  • subscriber_user_details.user_id
  • subscriber_user_details.email_address
getDashboardDetails A user accesses details of a draft dashboard, such as datasets and widgets. getDashboardDetails is always emitted when a user views a draft dashboard using UI or requests the dashboard definition using the API.
  • dashboard_id
createDashboard A user creates a new AI/BI dashboard using the UI or API.
  • dashboard_id
updateDashboard A user makes an update to an AI/BI dashboard using the UI or API.
  • dashboard_id
cloneDashboard A user clones an AI/BI dashboard.
  • source_dashboard_id
  • new_dashboard_id
publishDashboard A user publishes an AI/BI dashboard with shared or individual data permissions using the UI or API.
  • dashboard_id
  • credentials_embedded
  • warehouse_id
unpublishDashboard A user unpublishes a published AI/BI dashboard using the UI or API.
  • dashboard_id
trashDashboard A user moves a dashboard to the trash using the dashboard UI or Lakeview API commands. This event is logged only when performed through these channels, not for workspace actions. To audit workspace actions, see Workspace events.
  • dashboard_id
restoreDashboard A user restores an AI/BI dashboard from the trash using the dashboard UI or Lakeview API commands. This event is logged only when performed through these channels, not for workspace actions. To audit workspace actions, see Workspace events.
  • dashboard_id
migrateDashboard A user migrates a DBSQL dashboard to an AI/BI dashboard.
  • source_dashboard_id
  • new_dashboard_id
  • update_parameter_syntax
createSchedule A user creates an email subscription schedule.
  • dashboard_id
  • schedule_id
  • schedule
updateSchedule A user makes an update to an AI/BI dashboard's schedule.
  • dashboard_id
  • schedule_id
deleteSchedule A user deletes an AI/BI dashboard's schedule.
  • dashboard_id
  • schedule_id
createSubscription A user subscribes an email destination to an AI/BI dashboard schedule.
  • dashboard_id
  • schedule_id
  • schedule
deleteSubscription A user deletes an email destination from an AI/BI dashboard schedule.
  • dashboard_id
  • schedule_id

Alerts events

Important

This feature is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage Azure Databricks previews.

These events are logged at the workspace level. This service includes events related to alerts.

Note

This service does not record legacy alert events. Legacy alert events are logged under the databrickssql service.

These events are logged under the service_name of alerts.

action_name Description request_params
apiCreateAlert A user creates an alert using the Alerts V2 API.
  • alert.id
apiGetAlert A user gets an alert using the Alerts V2 API.
  • alert_id
apiTrashAlert A user deletes an alert using the Alerts V2 API.
  • alert_id
apiUpdateAlert A user updates an alert using the Alerts V2 API.
  • alert.id
cloneAlert A user clones an existing alert.
  • alert_id
createAlert A user creates a new alert.
  • alert_id
getAlert A user gets information about an alert using the UI.
  • alert_id
previewAlertEvaluate The Test condition feature returns the results of the alert test.
  • execution_session_id
previewAlertExecute A user uses the Test condition feature to preview and test their alert.
  • warehouse_id
runNowAlert A user clicks the Run now button to run the alert query immediately.
  • alert_id
updateAlert A user updates the details of an alert.
  • alert.id

Clusters events

These events are logged at the workspace level. This service includes events related to classic clusters.

These events are logged under the service_name of clusters.

action_name Description request_params
changeClusterAcl A user changes the cluster ACL.
  • shardName
  • aclPermissionSet
  • targetUserId
  • resourceId
changeOwner A user changes the owner of a cluster.
  • cluster_id
  • owner_username
create A user creates a cluster.
  • access_mode
  • acl_path_prefix
  • apply_policy_default_values
  • assigned_principal
  • autoscale
  • autotermination_minutes
  • azure_attributes
  • budget_policy_id
  • clone_from
  • cluster_creator
  • cluster_log_conf
  • cluster_name
  • cluster_source
  • cpu_architecture
  • custom_tags
  • data_security_mode
  • disk_spec
  • docker_image
  • driver_instance_pool_id
  • driver_instance_source
  • driver_node_type_id
  • effective_spark_version
  • enable_elastic_disk
  • enable_jobs_autostart
  • enable_local_disk_encryption
  • enable_serverless_compute
  • idempotency_token
  • init_scripts
  • instance_pool_id
  • instance_source
  • is_single_node
  • kind
  • nephos_virtual_driver_size
  • nephos_virtual_worker_size
  • no_driver_daemon
  • node_type_id
  • num_workers
  • organization_id
  • performance_target
  • platform_channel
  • policy_id
  • runtime_engine
  • single_user_name
  • spark_conf
  • spark_env_vars
  • spark_image_key
  • spark_version
  • ssh_public_keys
  • start_cluster
  • use_ml_runtime
  • user_id
  • validate_cluster_name_uniqueness
  • virtual_cluster_size
  • workload_type
createResult Results from cluster creation. In conjunction with create.
  • clusterName
  • clusterState
  • clusterId
  • clusterTerminationReasonCode
  • clusterWorkers
  • clusterOwnerUserId
delete A cluster is terminated.
  • cluster_id
  • termination_reason
deleteResult Results from cluster termination. In conjunction with delete.
  • clusterName
  • clusterState
  • clusterId
  • clusterTerminationReasonCode
  • clusterWorkers
  • clusterOwnerUserId
edit A user makes changes to cluster settings. This logs all changes except for changes in cluster size or autoscaling behavior.
  • acl_path_prefix
  • apply_policy_default_values
  • assigned_principal
  • autoscale
  • autotermination_minutes
  • azure_attributes
  • cluster_creator
  • cluster_id
  • cluster_log_conf
  • cluster_name
  • cluster_source
  • custom_tags
  • data_security_mode
  • docker_image
  • driver_instance_pool_id
  • driver_node_type_id
  • effective_spark_version
  • enable_elastic_disk
  • enable_local_disk_encryption
  • idempotency_token
  • init_scripts
  • instance_pool_id
  • is_single_node
  • kind
  • no_driver_daemon
  • node_type_id
  • num_workers
  • organization_id
  • policy_id
  • runtime_engine
  • single_user_name
  • spark_conf
  • spark_env_vars
  • spark_version
  • ssh_public_keys
  • start_cluster
  • use_ml_runtime
  • user_id
  • validate_cluster_name_uniqueness
  • virtual_cluster_size
  • workload_type
permanentDelete A cluster is deleted from the UI.
  • cluster_id
resize Cluster resizes. This is logged on running clusters where the only property that changes is either the cluster size or autoscaling behavior.
  • avoid_containers
  • autoscale
  • cluster_id
  • num_workers
resizeResult Results from cluster resize. In conjunction with resize.
  • clusterName
  • clusterState
  • clusterId
  • clusterWorkers
  • clusterOwnerUserId
restart A user restarts a running cluster.
  • cluster_id
restartResult Results from cluster restart. In conjunction with restart.
  • clusterName
  • clusterState
  • clusterId
  • clusterTerminationReasonCode
  • clusterWorkers
  • clusterOwnerUserId
start A user starts a cluster.
  • cluster_id
  • init_scripts_safe_mode
startResult Results from cluster start. In conjunction with start.
  • clusterName
  • clusterState
  • clusterId
  • clusterTerminationReasonCode
  • clusterWorkers
  • clusterOwnerUserId

Cluster libraries events

These events logged at the workspace level. This service includes events related to compute-scoped libraries.

These events are logged under the service_name of clusterLibraries.

action_name Description request_params
installLibraries User installs a library on a cluster.
  • cluster_id
  • libraries
  • are_installed_via_policy
  • replace
uninstallLibraries User uninstalls a library on a cluster.
  • cluster_id
  • libraries

Cluster policy events

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

These events are logged at the workspace level. This service includes events related to compute policies.

These events are logged under the service_name of clusterPolicies.

action_name Description request_params
create A user created a cluster policy.
  • name
  • libraries
  • max_clusters_per_user
  • policy_family_id
  • policy_family_version
edit A user edited a cluster policy.
  • policy_id
  • name
  • libraries
  • max_clusters_per_user
  • policy_family_id
  • policy_family_version
delete A user deleted a cluster policy.
  • policy_id
changeClusterPolicyAcl A workspace admin changes permissions for a cluster policy.
  • shardName
  • targetUserId
  • resourceId
  • aclPermissionSet

Genie chat events

These events are logged at the workspace level. This service covers Genie chat conversation tooling and internal RPCs. It is separate from the aibiGenie service, which covers Genie Spaces.

These events are logged under the service_name of genieChat.

action_name Description request_params
deleteGenieChatWorkspaceData An administrator deletes all Genie chat data associated with a workspace.
deleteGenieChatConversation A user deletes a Genie chat conversation.
  • conversation_id
mcpProxy A user invokes a tool on an MCP (Model Context Protocol) server through Azure Databricks.
updateGenieChatConversationShare A user updates the sharing settings of a Genie chat conversation.
  • conversation_id
  • share.acl.allow_account

Genie Space events

These events are logged at the workspace level. This service includes events related to Genie Spaces.

These events are logged under the service_name of aibiGenie.

action_name Description request_params
createSpace A user creates a new Genie Space. The space_id of the new space is logged in the response column.
createFile A user uploads a new file to a Genie conversation
  • space_id
  • conversation_id
deleteFile A user deletes a file from a Genie conversation
  • space_id
  • instruction_id
getSpace A user accesses the Genie Space.
  • space_id
listSpaces A user lists all available Genie Spaces.
updateSpace A user updates the settings of a Genie Space. This can include the title, description, warehouse, tables, sample questions, and the Run as setting, which determines if a shared space embeds the publisher's credentials or authenticates with the viewer's credentials.
  • space_id
  • display_name
  • description
  • warehouse_id
  • table_identifiers
  • run_as_type
trashSpace A Genie Space is moved to trash.
  • space_id
cloneSpace A user clones a Genie Space.
  • space_id
addDataSources A user adds data sources to a Genie Space.
  • space_id
removeDataSources A user removes data sources from a Genie Space.
  • space_id
updateGenieColumnConfigs A user updates column configurations for a Genie Space, including visibility, indexing, and sampling settings.
  • space_id
  • column_configs
genieGetSpace A user accesses details about a Genie Space using the API.
  • space_id
createConversation A user creates a new conversation thread in the Genie Space.
  • space_id
listConversations A user opens the list of conversations in the Genie Space.
  • space_id
genieStartConversationMessage A user starts a conversation thread with a message using the API.
  • space_id
  • conversation_id
getConversation A user opens a conversation thread in the Genie Space.
  • conversation_id
  • space_id
updateConversation A user updates a conversation thread's title.
  • conversation_id
  • space_id
deleteConversation A user deletes a conversation thread in the Genie Space.
  • conversation_id
  • space_id
listConversationShares A user accesses the list of shares for a conversation.
  • conversation_id
  • space_id
getConversationShare A user accesses the details of a conversation share.
  • conversation_id
  • share_id
  • space_id
updateConversationShare A user updates the sharing settings of a conversation.
  • conversation_id
  • share_id
  • space_id
createConversationMessage A user submits a new message to the Genie Space.
  • conversation_id
  • space_id
genieCreateConversationMessage A user creates a new message in a conversation using the API.
  • conversation_id
  • space_id
  • message_id
getConversationMessage A user accesses a message in the Genie Space.
  • conversation_id
  • space_id
  • message_id
genieGetConversationMessage A user retrieves a specific message in a conversation using the API.
  • conversation_id
  • space_id
  • message_id
deleteConversationMessage A user deletes an existing message.
  • conversation_id
  • space_id
  • message_id
regenerateConversationMessage A user regenerates a message response.
  • conversation_id
  • message_id
  • space_id
updateConversationMessage A user updates an existing message.
  • conversation_id
  • message_id
  • space_id
updateConversationMessageFeedback A user submits a feedback rating on a message.
  • conversation_id
  • feedback_rating
  • message_id
  • space_id
createConversationMessageAttachment A user creates an attachment on a message.
  • conversation_id
  • message_id
  • space_id
updateMessageAttachment A user updates an attachment on a message.
  • conversation_id
  • space_id
  • message_id
  • attachment_id
cancelMessage A user cancels a running message in a Genie Space.
  • conversation_id
  • message_id
  • space_id
listGenieSpaceMessages A user accesses the list of messages in a Genie Space.
  • space_id
listGenieSpaceUserMessages A user accesses the list of their own messages in a Genie Space.
  • space_id
getConversationFileUploadJob A user checks the status of a file upload job in a conversation.
  • space_id
  • conversation_id
  • job_id
genieGetMessageQueryResult Genie retrieves the query results associated with a message using the API.
  • conversation_id
  • space_id, message_id
genieGetMessageAttachmentQueryResult A user retrieves the query results for message attachments using the API.
  • conversation_id
  • space_id
  • attachment_id
executeFullQueryResult A user retrieves the full query results using the API (up to ~1GB in size).
  • space_id
  • conversation_id
  • message_id
genieExecuteMessageQuery Genie executes generated SQL to return query results, including refresh data actions using the API.
  • conversation_id
  • space_id
  • message_id
genieExecuteMessageAttachmentQuery Genie executes a query for message attachment results using the API.
  • conversation_id
  • space_id
  • message_id
  • attachment_id
getMessageQueryResult Genie retrieves the query results associated with a message.
  • conversation_id
  • space_id, message_id
executeQuery A user executes a query in a Genie Space.
  • space_id
getQueryResult A user retrieves query results from a Genie Space.
  • space_id
executeMessageQuery A user executes a query associated with a message.
  • conversation_id
  • space_id
  • message_id
executeMessageAttachmentQuery A user executes a query for a message attachment.
  • conversation_id
  • space_id
  • message_id
  • attachment_id
getMessageAttachmentQueryResult A user retrieves query results for a message attachment.
  • conversation_id
  • space_id
  • message_id
  • attachment_id
summarizeSqlExecutionResults Genie summarizes the results of a SQL query execution.
  • conversation_id
  • message_id
  • space_id
cancelStatement A user cancels a running SQL statement in a Genie Space.
  • space_id
createInstruction A user creates an instruction for a Genie Space.
  • space_id
  • instruction_type
listInstructions A user navigates to the Instructions tab or the Data tab.
  • space_id
  • conversation_id (Only used when listing fileinstructions in a conversation.)
updateInstruction A user updates an instruction for a Genie Space.
  • space_id
  • instruction_id
deleteInstruction A user deletes an instruction for a Genie Space.
  • space_id
  • instruction_id
updateSampleQuestions A user updates the default sample questions for the space.
  • space_id
createCuratedQuestion A user creates a sample question or benchmark question.
  • space_id
deleteCuratedQuestion A user deletes a sample question or benchmark question.
  • space_id
  • curated_question_id
listCuratedQuestions A user accesses the list of sample questions or benchmark questions in a space. This is logged whenever users open a new chat, view benchmarks, or add sample questions.
  • space_id
updateCuratedQuestion A user updates a sample question or benchmark question.
  • space_id
  • curated_question_id
createEvaluationResult Genie creates an evaluation result for a specific question in a benchmark run.
  • space_id
  • eval_id
getEvaluationResult A user accesses the results for a specific question in a benchmark run.
  • space_id
  • eval_id
getEvaluationResultDetails A user accesses the query results for a specific question in a benchmark run.
  • space_id
  • eval_id
updateEvaluationResult A user updates their evaluation result for a specific question.
  • space_id
  • eval_id
createEvaluationRun A user creates a new benchmark run.
  • space_id
listEvaluationResults A user accesses the list of results for an benchmark run.
  • space_id
  • run_id
listEvaluationRuns A user accesses the list of all benchmark runs.
  • space_id
getEvaluationRun A user accesses the details of a specific benchmark run.
  • run_id
  • space_id
cancelEvaluationRun A user cancels a running benchmark run.
  • space_id
  • run_id
resumeEvaluationRun A user resumes a previously canceled benchmark run.
  • space_id
  • run_id
deleteEvaluationRun A user deletes an benchmark run.
  • space_id
  • run_id
startBenchmarkSuggestions A user starts generating benchmark suggestions for a Genie Space.
  • space_id
getBenchmarkDebug A user accesses debug information for a specific benchmark result.
  • space_id
  • run_id
  • result_id
createConversationMessageComment A user adds a feedback comment to a message.
  • conversation_id
  • space_id
  • message_id
listConversationMessageComments A user accesses a list of the feedback comments from a space.
  • space_id
  • conversation_ids
  • message_ids
  • user_ids
  • comment_types
deleteConversationMessageComment A user deletes a feedback comment added to a message.
  • conversation_id
  • space_id
  • message_id
  • message_comment_id

Instance pool events

These events are logged at the workspace level. This service includes events related to pools.

These events are logged under the service_name of instancePools.

action_name Description request_params
changeInstancePoolAcl A user changes an instance pool's permissions.
  • shardName
  • resourceId
  • targetUserId
  • aclPermissionSet
create A user creates an instance pool.
  • azure_attributes
  • custom_tags
  • disk_spec
  • enable_elastic_disk
  • idle_instance_autotermination_minutes
  • instance_pool_name
  • max_capacity
  • min_idle_instances
  • node_type_flexibility
  • node_type_id
  • preloaded_docker_images
  • preloaded_spark_versions
delete A user deletes an instance pool.
  • instance_pool_id
edit A user edits an instance pool.
  • azure_attributes
  • custom_tags
  • disk_spec
  • enable_elastic_disk
  • idle_instance_autotermination_minutes
  • instance_pool_id
  • instance_pool_name
  • max_capacity
  • min_idle_instances
  • node_type_flexibility
  • node_type_id
  • preloaded_docker_images
  • preloaded_spark_versions

Job events

These events are logged at the workspace level. This service includes events related to jobs.

These events are logged under the service_name of jobs.

action_name Description request_params
cancel A job run is cancelled.
  • run_id
cancelAllRuns A user cancels all runs on a job.
  • all_queued_runs
  • job_id
changeJobAcl A user updates permissions on a job.
  • shardName
  • aclPermissionSet
  • resourceId
  • targetUserId
create A user creates a job.
  • budget_policy_id
  • compute
  • continuous
  • create_as_untouched
  • deployment
  • description
  • edit_mode
  • email_notifications
  • environments
  • existing_cluster_id
  • git_source
  • health
  • idempotency_token
  • job_clusters
  • job_type
  • libraries
  • max_concurrent_runs
  • max_retries
  • min_retry_interval_millis
  • name
  • new_cluster
  • notebook_task
  • notification_settings
  • parameters
  • performance_target
  • queue
  • retry_on_timeout
  • run_as
  • run_as_user_name
  • schedule
  • spark_jar_task
  • spark_python_task
  • spark_submit_task
  • tags
  • tasks
  • timeout_seconds
  • trigger
  • webhook_notifications
delete A user deletes a job.
  • job_id
deleteRun A user deletes a job run.
  • run_id
  • job_id
deleteTaskValues A user deletes task values for a job run.
  • ids
getRunOutput A user makes an API call to get a run output.
  • run_id
  • is_from_webapp
  • notebook_output_limit
  • skip_additional_acl_checks
repairRun A user repairs a job run.
  • run_id
  • latest_repair_id
  • rerun_tasks
  • rerun_all_failed_tasks
  • rerun_dependent_tasks
  • job_parameters
reset A job is reset.
  • job_id
  • new_settings
resetJobAcl A user requests the change of a job's permissions.
  • grants
  • job_id
runCommand Available when verbose audit logs are enabled. Emitted after a command in a notebook is executed by a job run. A command corresponds to a cell in a notebook.
  • jobId
  • runId
  • notebookId
  • executionTime
  • status
  • commandId
  • commandText
  • clusterId
  • commandLanguage
runFailed A job run fails or is canceled.
  • jobClusterType
  • jobTriggerType
  • jobId
  • jobTaskType
  • runId
  • jobTerminalState
  • idInJob
  • orgId
  • runCreatorUserName
  • clusterId
  • jobRunId
  • multitaskParentRunId
  • parentRunId
  • repairId
  • taskDependencies
  • taskDependencyType
  • taskKey
runNow A user triggers an on-demand job run.
  • notebook_params
  • job_id
  • jar_params
  • workflow_context
  • job_parameters
  • idempotency_token
  • only
  • performance_target
  • pipeline_params
  • python_params
  • queue
runStart Emitted when a job run starts after validation and cluster creation. The request parameters emitted from this event depend on the type of tasks in the job. In addition to the parameters listed, they can include:
  • dashboardId (for a SQL dashboard task)
  • filePath (for a SQL file task)
  • notebookPath (for a notebook task)
  • mainClassName (for a Spark JAR task)
  • pythonFile (for a Spark JAR task)
  • projectDirectory (for a dbt task)
  • commands (for a dbt task)
  • packageName (for a Python wheel task)
  • entryPoint (for a Python wheel task)
  • pipelineId (for a pipeline task)
  • queryIds (for a SQL query task)
  • alertId (for a SQL alert task)
  • taskDependencies
  • multitaskParentRunId
  • orgId
  • idInJob
  • jobId
  • jobTerminalState
  • taskKey
  • jobTriggerType
  • jobTaskType
  • runId
  • runCreatorUserName
runSucceeded A job run is successful.
  • idInJob
  • jobId
  • jobTriggerType
  • orgId
  • runId
  • jobClusterType
  • jobTaskType
  • jobTerminalState
  • runCreatorUserName
  • clusterId
  • jobRunId
  • multitaskParentRunId
  • parentRunId
  • repairId
  • taskDependencies
  • taskDependencyType
  • taskKey
runTriggered A job schedule is triggered automatically according to its schedule or trigger.
  • jobId
  • jobTriggeredType
  • runId
  • jobTriggerType
  • runCreatorUserName
sendRunWebhook A webhook is sent either when the job begins, completes, or fails.
  • orgId
  • jobId
  • jobWebhookId
  • jobWebhookEvent
  • runId
setTaskValue A user sets values for a task.
  • run_id
  • key
submitRun A user submits a one-time run via the API.
  • run_name
  • spark_python_task
  • existing_cluster_id
  • notebook_task
  • timeout_seconds
  • libraries
  • new_cluster
  • spark_jar_task
  • access_control_list
  • email_notifications
  • git_source
  • idempotency_token
  • run_as
  • tasks
  • workflow_context
update A user edits a job's settings.
  • job_id
  • fields_to_remove
  • new_settings

Lakeflow Spark Declarative Pipelines events

These events are logged at the workspace level. This service includes events related to Lakeflow Spark Declarative Pipelines.

These events are logged under the service_name of deltaPipelines.

action_name Description request_params
changePipelineAcls A user changes permissions on a pipeline.
  • aclPermissionSet
  • resourceId
  • shardName
  • targetUserId
create A user creates a declarative pipeline.
  • allow_duplicate_names
  • budget_policy_id
  • catalog
  • channel
  • clusters
  • configuration
  • continuous
  • data_sampling
  • dbr_version
  • deployment
  • development
  • dry_run
  • edition
  • email_notifications
  • event_log
  • event_log_spec
  • filters
  • gateway_definition
  • id
  • ingestion_definition
  • libraries
  • managed_definition
  • name
  • notifications
  • photon
  • pipeline_type
  • restart_window
  • run_as
  • schema
  • serverless
  • storage
  • tags
  • target
  • trigger
delete A user deletes a declarative pipeline.
  • cascade
  • pipeline_id
edit A user edits a declarative pipeline.
  • allow_duplicate_names
  • budget_policy_id
  • catalog
  • channel
  • clusters
  • configuration
  • continuous
  • data_sampling
  • dbr_version
  • deployment
  • development
  • edition
  • email_notifications
  • event_log
  • event_log_spec
  • expected_last_modified
  • filters
  • gateway_definition
  • id
  • ingestion_definition
  • libraries
  • managed_definition
  • name
  • notifications
  • photon
  • pipeline_id
  • pipeline_type
  • restart_window
  • run_as
  • schema
  • serverless
  • storage
  • tags
  • target
  • trigger
startUpdate A user restarts a declarative pipeline.
  • cause
  • development
  • explore_only
  • full_refresh
  • full_refresh_selection
  • idempotency_token
  • job_task
  • pipeline_id
  • refresh_selection
  • reset_checkpoint_selection
  • update_cause_details
  • usage_policy_id
  • validate_only
stop A user stops a declarative pipeline.
  • pipeline_id

Lakebase events

These events are logged at the workspace level. This service includes events related to Lakebase.

These events are logged under the service_name of databaseInstances.

action_name Description request_params
createDatabaseInstance A user creates a new database instance.
  • name
  • capacity
getDatabaseInstance A user queries for a database instance.
  • name
listDatabaseInstance A user queries for all database instances. none
updateDatabaseInstance A user updates properties on an existing instance. For example, its capacity or whether it is paused.
  • capacity
  • stopped
deleteDatabaseInstance A user hard deletes an instance.
  • name
  • force
  • purge
changeDatabaseInstanceAcl A user modifies permissions on a database instance. none
createDatabaseCatalog A user creates and registers a catalog in Unity Catalog for an existing database.
  • name
  • database_name
  • database_instance_name
deleteDatabaseCatalog A user unregisters a registered catalog from Unity Catalog.
  • name
getDatabaseCatalog A user queries for a database catalog.
  • name
createDatabaseTable A user creates a table inside a database on a database instance.
  • name
  • database_instance_name
  • database_name
getDatabaseTable A user queries for a database table.
  • name
deleteDatabaseTable A user deletes a database table from Unity Catalog.
  • name
createSyncedDatabaseTable A user creates a synced table inside a database on a database instance.
  • name
  • spec
  • scheduling_policy
  • source_table_full_name
  • primary_key_columns
getSyncedDatabaseTable A user queries for a synced table.
  • name
deleteSyncedDatabaseTable A user deletes a synced table from Unity Catalog.
  • name

Cloud storage metadata events

These events are logged at the workspace level. This service includes events related to cloud storage metadata operations used by Auto Loader and file arrival triggers.

These events are logged under the service_name of cloudStorageMetadata.

action_name Description request_params
listObjects A user or Auto Loader job fetches a paginated list of file changes (new, updated, or deleted files) from a cloud storage location or Unity Catalog volume. Clients use continuation tokens to incrementally fetch only files that changed since their last read.
  • uri: Cloud storage path
  • continuation_token: Opaque pagination token from a previous response
  • max_objects: Maximum objects to return (default 1,000, capped at 10,000)
  • include_updates: Whether to include updated objects (not just newly created objects)
  • include_deletes: Whether to include deleted objects
  • until_continuation_token: Optional upper-bound token at which to stop reading
  • omit_objects: If true, returns only count without object details
  • include_oldest_object_age: Whether to include the age of the oldest listed object
  • include_earliest_ingestion_time: Whether to include the earliest ingestion timestamp
  • workload_id: Workload identifier
  • caller_context_entries: Caller-provided context IDs for observability (for example, job_id, pipeline_id, run_id)
validateFileEventsPermissions Validates that credentials and cloud resources (queues, subscriptions) are properly configured for file event notifications on a cloud storage location. Called when a user enables managed file notifications for an external location in Unity Catalog.
  • url: Cloud storage path to validate
  • credential_name: Name of the Unity Catalog storage credential to validate
  • provided_sqs: User-provided AWS SQS queue
  • provided_aqs: User-provided Azure Queue Storage
  • provided_pubsub: User-provided GCP Pub/Sub
  • managed_sqs: Azure Databricks-managed AWS SQS
  • managed_aqs: Azure Databricks-managed Azure Queue Storage
  • managed_pubsub: Azure Databricks-managed GCP Pub/Sub

Ingestion events

The following event is logged at the workspace level and is related to file uploads.

These events are logged under the service_name of ingestion.

action_name Description request_params
proxyFileUpload A user uploads a file to their Azure Databricks workspace.
  • x-databricks-content-length-0
  • x-databricks-total-files

Lineage tracking events

These events are logged at the workspace level. This service includes events related to data lineage.

These events are logged under the service_name of lineageTracking.

action_name Description request_params
listColumnLineages A user accesses the list of the upstream or downstream columns of a column.
  • table_name
  • column_name
  • lineage_direction: The lineage direction (UPSTREAM or DOWNSTREAM).
listSecurableLineagesBySecurable A user accesses the list of the upstream or downstream securables of a securable.
  • securable_full_name
  • securable_type
  • lineage_direction: The lineage direction (UPSTREAM or DOWNSTREAM).
  • metastore_id
  • page_size
  • page_token
  • securable_response_filter
  • start_timestamp
  • subsecurable_id
  • workspace_id
listEntityLineagesBySecurable A user accesses the list of entities (notebooks, jobs, etc.) that write to or read a securable.
  • securable_full_name
  • securable_type
  • lineage_direction: The lineage direction (UPSTREAM or DOWNSTREAM).
  • entity_response_filter: The entity type (notebook, job, dashboard, pipeline, query, serving endpoint, etc.).
  • metastore_id
  • page_size
  • start_timestamp
  • subsecurable_id
  • workspace_id
getColumnLineages A user gets the column lineages for a table and its column.
  • table_name
  • column_name
  • metastore_id
  • only_downstream
  • only_upstream
  • workspace_id
getTableEntityLineages A user gets the upstream and downstream lineages of a table.
  • table_name
  • include_entity_lineage
  • include_downstream
  • include_upstream
  • metastore_id
  • workspace_id
getJobTableLineages A user gets the upstream and downstream table lineages of a job.
  • job_id
  • max_result
  • metastore_id
  • workspace_id
getFunctionLineages A user gets the upstream and downstream securables and entities (notebooks, jobs, etc.) of a function.
  • function_name
getModelVersionLineages A user gets the upstream and downstream securables and entities (notebooks, jobs, etc.) of a model and its version.
  • model_name
  • version
  • metastore_id
  • workspace_id
getEntityTableLineages A user gets the upstream and downstream tables of an entity (notebooks, jobs, etc.).
  • entity_type
  • entity_id
  • max_downstreams
  • max_upstreams
  • metastore_id
  • workspace_id
getFrequentlyJoinedTables A user gets the frequently joined tables for a table.
  • table_name
  • include_columns
  • limit_size
  • metastore_id
  • workspace_id
getFrequentQueryByTable A user gets the frequent queries for a table.
  • source_table_name
  • limit_size
  • metastore_id
  • workspace_id
getFrequentUserByTable A user gets the frequent users for a table.
  • table_name
  • limit_size
  • metastore_id
  • workspace_id
getTablePopularityByDate A user gets the popularity (query count) for a table for the past month.
  • table_name
  • metastore_id
  • workspace_id
getPopularEntities A user gets the popular entities (notebooks, jobs, etc.) for a table.
  • scope: Specifies the scope for retrieving popular entities, either from the workspace or table name.
  • table_name
  • limit_size
  • metastore_id
  • workspace_id
getPopularTables A user gets the table popularity info for a list of tables.
  • scope: Specifies the scope for retrieving popular tables, either from the metastore or the table list.
  • table_name_list
  • metastore_id
  • workspace_id
listCustomLineages A user lists custom lineages for an entity.
  • entity_id
  • lineage_direction
  • metastore_id
  • page_size
  • workspace_id
listSecurableByEntityEvent A user lists securables associated with entity events.
  • entity_id
  • entity_type
  • lineage_direction
  • metastore_id
  • page_size
  • page_token
  • securable_response_filter
  • start_timestamp
  • workspace_id

Data monitoring events

These events are logged at the workspace level. This service includes events related to Data Quality Monitoring.

These events are logged under the service_name of dataMonitoring.

action_name Description request_params
CancelRefresh User cancels a monitor refresh.
  • full_table_name_arg
  • refresh_id
CreateMonitor User creates a monitor.
  • data_classification_config
  • full_table_name_arg
  • assets_dir
  • schedule
  • output_schema_name
  • notifications
  • inference_log
  • custom_metrics
  • slicing_exprs
  • snapshot
  • time_series
DeleteMonitor User deletes a monitor.
  • full_table_name_arg
RegenerateDashboard User regenerates a monitor dashboard.
  • full_table_name_arg
RunRefresh Monitor is refreshed, either by schedule or manually.
  • full_table_name_arg
UpdateMonitor User makes an update to a monitor.
  • data_classification_config
  • table_name
  • full_table_name_arg
  • drift_metrics_table_name
  • dashboard_id
  • custom_metrics
  • assets_dir
  • monitor_version
  • profile_metrics_table_name
  • baseline_table_name
  • status
  • output_schema_name
  • inference_log
  • slicing_exprs
  • latest_monitor_failure_msg
  • notifications
  • schedule
  • snapshot

Request for access events

These events are logged at the workspace level. This service includes events related to access request destinations (Public Preview).

These events are logged under the service_name of request-for-access.

action_name Description request_params
updateAccessRequestDestinations A user updates access request destinations for a Unity Catalog securable.
  • destinations
  • securable
getAccessRequestDestinations A user gets access request destinations for a Unity Catalog securable.
  • full_name
  • securable_type
listDestinations A user gets access request destinations for a Unity Catalog securable. This is a legacy version of the getAccessRequestDestinations action.
  • securable
getStatus A user gets status information for a Unity Catalog securable. Request for access is considered enabled for a Unity Catalog securable if at least one access request destination exists.
  • securable
batchCreateAccessRequests A user requests access for one or more Unity Catalog securables.
  • requests
requestAccess A user requests access for a single Unity Catalog securable. This is a legacy version of the batchCreateAccessRequests action.
  • behalf_of
  • comment
  • privileges
  • securable
updateDefaultDestinationStatus A user updates the status of a workspace-level setting that controls whether all Unity Catalog securables have a default destination assigned. none
getDefaultDestinationStatus A user gets the status of the default destination setting. none

Domains events

These events are logged at the workspace level. This service includes events related to Domains.

These events are logged under the service_name of domains.

action_name Description request_params
createDomain User creates a domain.
  • domain_id
  • draft
  • icon
  • tag_key
updateDomain User updates a domain.
  • domain_id
  • draft
  • icon
deleteDomain User deletes a domain.
  • domain_id
listDomains User lists available domains.

Discover Page events

These events are logged at the workspace level. This service includes events related to the Discover Page.

These events are logged under the service_name of discover.

action_name Description request_params
getDiscoverPageDraft User retrieves the draft version of the Discover Page.
  • name
getDiscoverPagePublished User retrieves the published version of the Discover Page.
  • name
updateDiscoverPageDraft User updates the draft version of the Discover Page.
  • name
  • sections
updateDiscoverPagePublished User updates the published version of the Discover Page.
  • name
  • sections

Uniform Iceberg REST API events

These events are logged at the workspace level. These events are logged when users interact with managed Apache Iceberg tables using an external Iceberg-compatible engine that supports the Iceberg REST Catalog API.

These events are logged under the service_name of uniformIcebergRestCatalog.

action_name Description request_params
config User gets a catalog configuration.
  • http_method
  • http_path
createNamespace User creates a namespace, with an optional set of properties.
  • http_method
  • http_path
createTable User creates a new Iceberg table.
  • http_method
  • http_path
deleteNamespace User deletes an existing namespace.
  • http_method
  • http_path
deleteTable User deletes an existing table.
  • http_method
  • http_path
getNamespace User gets properties of a namespace.
  • http_method
  • http_path
listNamespaces User makes a call to list all namespaces at a specified level.
  • http_method
  • http_path
listTables User lists all tables under a given namespace.
  • http_method
  • http_path
loadTableCredentials User loads vended credentials for a table from the catalog.
  • http_method
  • http_path
loadTable User loads a table from the catalog.
  • http_method
  • http_path
loadView User loads a view from the catalog.
  • http_method
  • http_path
namespaceExists User checks if a namespace exists.
  • http_method
  • http_path
renameTable User renames an existing table
  • http_method
  • http_path
reportMetrics User sends a metrics report
  • http_method
  • http_path
tableExists User checks if a table exists within a given namespace.
  • http_method
  • http_path
updateNamespaceProperties User updates properties for a namespace.
  • http_method
  • http_path
updateTable User updates table metadata.
  • http_method
  • http_path
viewExists User checks if a view exists within a given namespace.
  • http_method
  • http_path

Predictive optimization events

These events are logged at the workspace level. This service includes events related to predictive optimization.

These events are logged under the service_name of predictiveOptimization.

action_name Description request_params
PutMetrics Recorded when predictive optimization updates table and workload metrics so the service can more intelligently schedule optimization operations.
  • table_metrics_list
  • start_time
  • end_time

DBFS events

These events are logged at the workspace level. This service includes events related to DBFS.

There are two types of DBFS events: API calls and operational events.

DBFS API events

These audit events are only logged when written through the DBFS REST API.

These events are logged under the service_name of dbfs.

action_name Description request_params
addBlock User appends a block of data to the stream. This is used in conjunction with dbfs/create to stream data to DBFS.
  • handle
  • data_length
close User closes a stream specified by the input handle.
  • handle
create User opens a stream to write a file to DBFS.
  • path
  • bufferSize
  • overwrite
delete User deletes the file or directory from DBFS.
  • recursive
  • path
getStatus User gets information for a file or directory.
  • path
mkdirs User creates a new DBFS directory.
  • path
move User moves a file from one location to another location within DBFS.
  • dst
  • source_path
  • src
  • destination_path
put User uploads a file through the use of a multipart form post to DBFS.
  • path
  • overwrite
read User reads the contents of a file.
  • path
  • offset
  • length

DBFS operational events

These audit events occur at the compute plane.

These events are logged under the service_name of dbfs.

action_name Description request_params
mount User creates a mount point at a certain DBFS location.
  • mountPoint
  • owner
unmount User removes a mount point at a certain DBFS location.
  • mountPoint

Files events

These events are logged at the workspace level. This service includes events related to file management, which includes interacting with files using the Files API or in the volumes UI.

These events are logged under the service_name of filesystem.

action_name Description request_params
directoriesDelete A user deletes a directory using the Files API or the volumes UI.
  • path
directoriesGet A user lists the contents of a directory using the Files API or the volumes UI.
  • path
directoriesHead A user gets information about a directory using the Files API or the volumes UI.
  • path
directoriesPut A user creates a directory using the Files API or the volumes UI.
  • path
filesDelete User deletes a file using the Files API or the volumes UI.
  • path
filesGet User downloads a file using the Files API or the volumes UI.
  • path
  • transferredSize
filesHead User gets information about a file using the Files API or the volumes UI.
  • path
filesPut User uploads a file using the Files API or the volumes UI.
  • path
  • receivedSize

Workspace files events

These events are logged at the workspace level. This service includes events related to workspaces files.

These events are logged under the service_name of workspaceFiles.

action_name Description request_params
wsfsStreamingRead A workspace file is read by a user or programmatically as part of a workflow.
  • path
wsfsStreamingWrite A workspace file is written to by a user or programmatically as part of a workflow.
  • path
wsfsImportFile A user imports a file into the workspace.
  • path

Agent evaluation events

These events are logged at the workspace level. This service includes events related to agent evaluation, including production monitoring, evaluation datasets, human evaluation, and synthetic evaluation data generation.

Production monitoring events

These events are related to production monitoring, including scorers, metric backfill, and trace archival.

These events are logged under the service_name of agentEvaluation.

action_name Description request_params
getChatAssessments A user requests LLM-judge assessments on an agent response.
  • experiment_id
  • requested_assessments
getChatCompletions A user requests an LLM to evaluate an agent response. For example, by invoking a judge created by make_judge. none
createScheduledScorers A user creates scorers for an experiment.
  • experiment_id
  • scheduled_scorers.scorers.name
  • scheduled_scorers.scorers.sample_rate
getScheduledScorers A user retrieves scorers for an experiment.
  • experiment_id
updateScheduledScorers A user updates scorers for an experiment.
  • experiment_id
  • scheduled_scorers.scorers.name
  • scheduled_scorers.scorers.sample_rate
deleteScheduledScorers A user deletes scorers for an experiment.
  • experiment_id
runMetricBackfill A user runs a metric backfill for an experiment.
  • experiment_id
  • start_timestamp_ms
  • end_timestamp_ms
startTraceArchival A user starts trace archival for an experiment.
  • experiment_id
  • archive_table_fullname
stopTraceArchival A user stops trace archival for an experiment.
  • experiment_id

Evaluation dataset events

These events are related to evaluation datasets, including CRUD operations for datasets and dataset records, batch operations, and expectations management.

These events are logged under the service_name of agentEvaluation.

action_name Description request_params
createDataset A user creates an evaluation dataset.
  • dataset.dataset_id
  • dataset.name
getDataset A user retrieves an evaluation dataset.
  • dataset_id
listDatasets A user lists evaluation datasets.
  • filter
  • order_by
updateDataset A user updates an evaluation dataset.
  • dataset_id
  • dataset.dataset_id
  • dataset.name
deleteDataset A user deletes an evaluation dataset.
  • dataset_id
createDatasetRecord A user creates a record in an evaluation dataset.
  • dataset_id
  • dataset_record.dataset_record_id
getDatasetRecord A user retrieves a record from an evaluation dataset.
  • dataset_id
  • dataset_record_id
listDatasetRecords A user lists records in an evaluation dataset.
  • dataset_id
updateDatasetRecord A user updates a record in an evaluation dataset.
  • dataset_id
  • dataset_record_id
  • dataset_record.dataset_record_id
deleteDatasetRecord A user deletes a record from an evaluation dataset.
  • dataset_id
  • dataset_record_id
batchCreateDatasetRecords A user creates multiple records in an evaluation dataset in a single batch operation.
  • dataset_id
  • requests.dataset_id
  • requests.dataset_record.dataset_record_id
upsertExpectations A user upserts expectations for a record in an evaluation dataset.
  • dataset_id
  • dataset_record_id

Synthetic data generation events

These events are related to synthetic evaluation data generation.

These events are logged under the service_name of agentEvaluation.

action_name Description request_params
generateQuestions A user generates synthetic questions for evaluation.
  • experiment_id
  • instance_id
  • num_questions
generateAnswer A user generates synthetic answers for evaluation.
  • answer_types
  • experiment_id
  • instance_id

Review app events

These events are related to review apps for human evaluation, including review app management, labeling sessions, and item management.

These events are logged under the service_name of agentEvaluation.

action_name Description request_params
createReviewApp A user creates a review app for human evaluation.
  • review_app.experiment_id
  • review_app.review_app_id
getReviewApp A user retrieves a review app.
  • review_app_id
listReviewApps A user lists review apps. none
updateReviewApp A user updates a review app.
  • review_app.experiment_id
  • review_app.review_app_id
  • review_app_id
createLabelingSession A user creates a labeling session in a review app.
  • labeling_session.labeling_session_id
  • labeling_session.mlflow_run_id
  • labeling_session.name
  • review_app_id
getLabelingSession A user retrieves a labeling session from a review app.
  • labeling_session_id
  • review_app_id
listLabelingSessions A user lists labeling sessions in a review app.
  • review_app_id
updateLabelingSession A user updates a labeling session in a review app.
  • labeling_session.labeling_session_id
  • labeling_session.mlflow_run_id
  • labeling_session.name
  • labeling_session_id
  • review_app_id
deleteLabelingSession A user deletes a labeling session from a review app.
  • review_app_id
  • labeling_session_id
batchCreateItems A user creates multiple items in a labeling session in a single batch operation.
  • items.item_id
  • labeling_session_id
  • review_app_id
getItem A user retrieves an item from a labeling session.
  • review_app_id
  • labeling_session_id
  • item_id
listItems A user lists items in a labeling session.
  • labeling_session_id
  • review_app_id
updateItem A user updates an item in a labeling session.
  • review_app_id
  • labeling_session_id
  • item_id
  • item.item_id
batchDeleteItems A user deletes multiple items from a labeling session in a single batch operation.
  • review_app_id
  • labeling_session_id
  • item_ids

Knowledge Assistant events

These events are logged at the workspace level. This service includes events related to managing Knowledge Assistants, their knowledge sources, and example questions, using the SDK or the Agent Bricks UI.

Knowledge Assistant management events

The following events are related to creating, retrieving, updating, listing, and deleting Knowledge Assistants, and to syncing their knowledge sources.

These events are logged under the service_name of knowledgeAssistant.

action_name Description request_params
create A user creates a Knowledge Assistant.
  • knowledge_assistant.creator
  • knowledge_assistant.display_name
  • knowledge_assistant.endpoint_name
  • knowledge_assistant.error_info
  • knowledge_assistant.experiment_id
  • knowledge_assistant.id
  • knowledge_assistant.name
  • knowledge_assistant.state
get A user retrieves a Knowledge Assistant.
  • name
update A user updates a Knowledge Assistant.
  • knowledge_assistant.creator
  • knowledge_assistant.display_name
  • knowledge_assistant.endpoint_name
  • knowledge_assistant.error_info
  • knowledge_assistant.experiment_id
  • knowledge_assistant.id
  • knowledge_assistant.name
  • knowledge_assistant.state
delete A user deletes a Knowledge Assistant.
  • name
list A user lists Knowledge Assistants. none
syncKnowledgeSources A user starts a sync of the knowledge sources for a Knowledge Assistant.
  • name

Knowledge source events

The following events are related to knowledge sources attached to a Knowledge Assistant.

These events are logged under the service_name of knowledgeAssistant.

action_name Description request_params
createKnowledgeSource A user creates a knowledge source for a Knowledge Assistant.
  • parent
  • knowledge_source.display_name
  • knowledge_source.file_table.table_name
  • knowledge_source.files.path
  • knowledge_source.index.index_name
  • knowledge_source.name
getKnowledgeSource A user retrieves a knowledge source.
  • name
listKnowledgeSources A user lists knowledge sources for a Knowledge Assistant.
  • parent
updateKnowledgeSource A user updates a knowledge source.
  • name
  • knowledge_source.display_name
  • knowledge_source.file_table.table_name
  • knowledge_source.files.path
  • knowledge_source.index.index_name
  • knowledge_source.name
deleteKnowledgeSource A user deletes a knowledge source.
  • name

Example events

The following events are related to example questions and guidelines used to tune a Knowledge Assistant.

These events are logged under the service_name of supervisorAgent.

action_name Description request_params
createExample A user creates an example for a Knowledge Assistant.
  • parent
  • example.example_id
  • example.guidelines
  • example.name
  • example.question
getExample A user retrieves an example.
  • name
listExamples A user lists examples for a Knowledge Assistant.
  • parent
updateExample A user updates an example.
  • name
  • example.example_id
  • example.guidelines
  • example.name
  • example.question
deleteExample A user deletes an example.
  • name
importExamples A user imports examples for a Knowledge Assistant from a Unity Catalog table.
  • name
  • table_name
exportExamples A user exports examples for a Knowledge Assistant to a Unity Catalog table.
  • name
  • table_name

Supervisor Agent events

These events are logged at the workspace level. This service includes events related to managing Supervisor Agents, their tools, and example questions, using the SDK or the Agent Bricks UI.

Supervisor Agent management events

The following events are related to creating, retrieving, updating, listing, and deleting Supervisor Agents.

These events are logged under the service_name of supervisorAgent.

action_name Description request_params
create A user creates a Supervisor Agent.
  • supervisor_agent.creator
  • supervisor_agent.endpoint_name
  • supervisor_agent.experiment_id
  • supervisor_agent.name
  • supervisor_agent.supervisor_agent_id
get A user retrieves a Supervisor Agent.
  • name
update A user updates a Supervisor Agent.
  • supervisor_agent.creator
  • supervisor_agent.endpoint_name
  • supervisor_agent.experiment_id
  • supervisor_agent.name
  • supervisor_agent.supervisor_agent_id
delete A user deletes a Supervisor Agent.
  • name
list A user lists Supervisor Agents. none

Tool events

The following events are related to tools attached to a Supervisor Agent.

These events are logged under the service_name of supervisorAgent.

action_name Description request_params
createTool A user adds a tool to a Supervisor Agent.
  • parent
  • tool_id
  • tool.name
  • tool.tool_id
  • tool.tool_type
getTool A user retrieves a tool.
  • name
listTools A user lists tools for a Supervisor Agent.
  • parent
updateTool A user updates a tool.
  • tool.name
  • tool.tool_id
  • tool.tool_type
deleteTool A user deletes a tool.
  • name

Example events

The following events are related to example questions and guidelines used to tune a Supervisor Agent.

These events are logged under the service_name of supervisorAgent.

action_name Description request_params
createExample A user creates an example for a Supervisor Agent.
  • parent
  • example.example_id
  • example.guidelines
  • example.name
  • example.question
getExample A user retrieves an example.
  • name
listExamples A user lists examples for a Supervisor Agent.
  • parent
updateExample A user updates an example.
  • name
  • example.example_id
  • example.guidelines
  • example.name
  • example.question
deleteExample A user deletes an example.
  • name

MLflow experiment events

These events are logged at the workspace level. This service includes events related to MLflow experiments.

These events are logged under the service_name of mlflowExperiment.

action_name Description request_params
createMlflowExperiment A user creates an MLflow experiment.
  • experimentId
  • path
  • experimentName
deleteMlflowExperiment A user deletes an MLflow experiment.
  • experimentId
  • path
  • experimentName
moveMlflowExperiment A user moves an MLflow experiment.
  • newPath
  • experimentId
  • oldPath
restoreMlflowExperiment A user restores an MLflow experiment.
  • experimentId
  • path
  • experimentName
renameMlflowExperimentEvent A user renames an MLflow experiment.
  • oldName
  • newName
  • experimentId
  • parentPath

MLflow artifacts with ACL events

These events are logged at the workspace level. This service includes events related to MLflow artifacts with ACLs.

These events are logged under the service_name of mlflowAcledArtifact.

action_name Description request_params
readArtifact A user makes call to read an artifact.
  • artifactLocation
  • experimentId
  • runId
writeArtifact A user makes call to write to an artifact.
  • artifactLocation
  • experimentId
  • runId

MLflow model registry events

These events are logged at the workspace level. This service includes events related to the workspace model registry. For activity logs for models in Unity Catalog, see Unity Catalog events.

These events are logged under the service_name of modelRegistry.

action_name Description request_params
approveTransitionRequest A user approves a model version stage transition request.
  • name
  • version
  • stage
  • archive_existing_versions
  • comment
changeRegisteredModelAcl A user updates permissions for a registered model.
  • registeredModelId
  • userId
  • aclPermissionSet
  • resourceId
  • shardName
  • targetUserId
createComment A user posts a comment on a model version.
  • name
  • version
createModelVersion A user creates a model version.
  • name
  • source
  • run_id
  • tags
  • run_link
createRegisteredModel A user creates a new registered model
  • name
  • tags
  • description
createRegistryWebhook User creates a webhook for Model Registry events.
  • orgId
  • registeredModelId
  • events
  • description
  • status
  • creatorId
  • httpUrlSpec
createTransitionRequest A user creates a model version stage transition request.
  • name
  • version
  • stage
  • comment
deleteComment A user deletes a comment on a model version.
  • id
deleteModelVersion A user deletes a model version.
  • name
  • version
deleteModelVersionTag A user deletes a model version tag.
  • name
  • version
  • key
deleteRegisteredModel A user deletes a registered model
  • name
deleteRegisteredModelTag A user deletes the tag for a registered model.
  • name
  • key
deleteRegistryWebhook User deletes a Model Registry webhook.
  • orgId
  • webhookId
deleteTransitionRequest A user cancels a model version stage transition request.
  • name
  • version
  • stage
  • creator
finishCreateModelVersionAsync Completed asynchronous model copying.
  • name
  • version
generateBatchInferenceNotebook Batch inference notebook is autogenerated.
  • userId
  • orgId
  • modelName
  • inputTableOpt
  • outputTablePathOpt
  • stageOrVersion
  • modelVersionEntityOpt
  • notebookPath
generateDltInferenceNotebook Inference notebook for a declarative pipeline is autogenerated.
  • userId
  • orgId
  • modelName
  • inputTable
  • outputTable
  • stageOrVersion
  • notebookPath
  • input_table
  • name
  • output_table
  • stage
  • version
getModelVersionDownloadUri A user gets a URI to download the model version.
  • name
  • version
getModelVersionSignedDownloadUri A user gets a URI to download a signed model version.
  • name
  • version
  • path
listModelArtifacts A user makes a call to list a model's artifacts.
  • name
  • version
  • path
  • page_token
listRegistryWebhooks A user makes a call to list all registry webhooks in the model.
  • orgId
  • registeredModelId
rejectTransitionRequest A user rejects a model version stage transition request.
  • name
  • version
  • stage
  • comment
renameRegisteredModel A user renames a registered model
  • name
  • new_name
setEmailSubscriptionStatus A user updates the email subscription status for a registered model
  • model_name
  • subscription_type
setModelVersionTag A user sets a model version tag.
  • name
  • version
  • key
  • value
setRegisteredModelTag A user sets a model version tag.
  • name
  • key
  • value
setUserLevelEmailSubscriptionStatus A user updates their email notifications status for the whole registry.
  • orgId
  • userId
  • subscriptionStatus
  • subscription_type
testRegistryWebhook A user tests the Model Registry webhook.
  • orgId
  • webhookId
transitionModelVersionStage A user gets a list of all open stage transition requests for the model version.
  • name
  • version
  • stage
  • archive_existing_versions
  • comment
triggerRegistryWebhook A Model Registry webhook is triggered by an event.
  • orgId
  • registeredModelId
  • events
  • status
updateComment A user post an edit to a comment on a model version.
  • id
updateRegistryWebhook A user updates a Model Registry webhook.
  • orgId
  • webhookId

Model serving events

These events are logged at the workspace level. This service includes events related to model serving.

These events are logged under the service_name of serverlessRealTimeInference.

action_name Description request_params
cancelUpdateServingEndpoint User cancels an in-progress update of a model serving endpoint.
  • name
changeInferenceEndpointAcl User updates permissions for an inference endpoint.
  • shardName
  • targetUserId
  • resourceId
  • aclPermissionSet
createServingEndpoint User creates a model serving endpoint.
  • name
  • config
deleteServingEndpoint User deletes a model serving endpoint.
  • name
getQuerySchemaPreview Users makes a call to get the query schema preview.
  • endpoint_name
patchInferenceEndpointUsagePolicy User updates the usage policy of a serving endpoint.
  • name
putInferenceEndpointAiGateway User updates the AI Gateway configuration for a serving endpoint, including rate limits, guardrails, inference tables, fallbacks, and usage tracking
  • name
  • ai_gateway_config
startServingEndpoint User starts a model serving endpoint.
  • name
stopServingEndpoint User stops a model serving endpoint.
  • name
updateServingEndpoint User updates a model serving endpoint.
  • name
  • served_models
  • traffic_config

Feature store events

These events are logged at the workspace level. This service includes events related to the Databricks Feature Store.

These events are logged under the service_name of featureStore.

action_name Description request_params
addConsumer A consumer is added to the feature store.
  • features
  • job_run
  • notebook
addDataSources A data source is added to a feature table.
  • feature_table
  • paths
  • tables
addProducer A producer is added to a feature table.
  • feature_table
  • job_run
  • notebook
  • producer_action
changeFeatureTableAcl Permissions are changed in a feature table.
  • aclPermissionSet
  • resourceId
  • shardName
  • targetUserId
createFeatureSpec A feature specification is created.
  • feature_spec_yaml
  • name
createFeatureTable A feature table is created.
  • description
  • is_imported
  • name
  • partition_keys
  • primary_keys
  • timestamp_keys
createFeatures Features are created in a feature table.
  • feature_table
  • features
deleteFeatureTable A feature table is deleted.
  • dry_run
  • name
deleteTags Tags are deleted from a feature table.
  • feature_table_id
  • keys
generateFeatureSpecYaml A feature specification YAML is generated.
  • exclude_columns
  • feature_spec_yaml
  • features
  • input_columns
getBrickstoreOnlineTableMetadata A user gets Brickstore online table metadata.
  • feature_table_features
getConsumers A user makes a call to get the consumers in a feature table.
  • feature_table
getFeatureStoreWidePermissions A user gets feature store-wide permissions. none
getFeatureTable A user makes a call to get feature tables.
  • exclude_online_stores
  • include_producers
  • name
getFeatureTablesById A user makes a call to get feature table IDs.
  • ids
getFeatures A user makes a call to get features.
  • feature_table
  • max_results
getModelServingMetadata A user makes a call to get Model Serving metadata.
  • feature_table_features
getOnlineFeatureTables A user gets online feature tables.
  • create_if_not_exist
  • feature_table_features
  • include_brickstore
  • is_v1_serving
getOnlineStore A user makes a call to get online store details.
  • cloud
  • feature_table
  • online_table
  • store_type
getOnlineStores A user gets online stores.
  • feature_tables
getTags A user makes a call to get tags for a feature table.
  • feature_table_id
logFeatureStoreClientEvent A feature store client event is logged.
  • aggregate_features
  • create_materialized_view
publishFeatureTable A feature table is published.
  • cloud
  • feature_table
  • host
  • online_table
  • port
  • read_secret_prefix
  • store_type
  • write_secret_prefix
searchFeatureTables A user searches for feature tables.
  • catalog_names
  • exclude_online_stores
  • is_multi_catalog
  • max_results
  • owner_ids
  • page_token
  • search_scopes
  • sort_order
  • text
setTags Tags are added to a feature table.
  • feature_table_id
  • tags
updateFeatureTable A feature table is updated.
  • description
  • name

Unity Catalog HTTP connection events

These events are logged at the workspace level when requests are proxied through a Unity Catalog HTTP connection, such as when calling external functions or connecting to external MCP servers.

These events are logged under the service_name of ucHttpConnection.

action_name Description request_params
ucHttpConnectionProxiedRequest A request is proxied through a Unity Catalog HTTP connection to an external endpoint.
  • auth_type
  • connection_id
  • connection_name
  • http_method

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

These events are logged at the workspace level. This service includes events related to Mosaic AI Vector Search.

These events are logged under the service_name of vectorSearch.

action_name Description request_params
createEndpoint User creates a vector search endpoint.
  • name
  • endpoint_type
deleteEndpoint User deletes a vector search endpoint.
  • name
changeEndpointAcl User updates permissions on a vector search endpoint.
  • access_control_list
  • request_object_id
  • request_object_type
createVectorIndex User creates a vector search index.
  • name
  • endpoint_name
  • primary_key
  • index_type
  • delta_sync_index_spec
  • direct_access_index_spec
deleteVectorIndex User deletes a vector search index.
  • name
  • endpoint_name (optional)
  • delete_embedding_writeback_table
changeEndpointAcl User changes access control list for an endpoint.
  • name
  • endpoint_name
  • access_control_list
queryVectorIndex User queries a vector search index.
  • name
  • endpoint_name (optional)
queryVectorIndexNextPage User reads the paginated results of a vector search index query.
  • name
  • endpoint_name (optional)
scanVectorIndex User scans all data in a vector search index.
  • name
  • endpoint_name (optional)
upsertDataVectorIndex User upserts data in a Direct Access vector search index.
  • name
  • endpoint_name (optional)
deleteDataVectorIndex User deletes data in a Direct Access vector search index.
  • name
  • endpoint_name (optional)
queryVectorIndexRouteOptimized User queries a vector search index using a low-latency API route.
  • name
  • endpoint_name (optional)
queryVectorIndexNextPageRouteOptimized User reads the paginated results of a vector search index query using a low-latency API route.
  • name
  • endpoint_name (optional)
scanVectorIndexRouteOptimized User scans all data in a vector search index using a low-latency API route.
  • name
  • endpoint_name (optional)
upsertDataVectorIndexRouteOptimized User upserts data in a Direct Access vector search index using a low-latency API route.
  • name
  • endpoint_name (optional)
deleteDataVectorIndexRouteOptimized User deletes data in a Direct Access vector search index using a low-latency API route.
  • name
  • endpoint_name (optional)

Databricks SQL events

These events are logged at the workspace level. This service includes events related to Databricks SQL.

Note

If you manage your SQL warehouses using the legacy SQL endpoints API, your SQL warehouse audit events will have different action names. See SQL endpoint logs.

These events are logged under the service_name of databrickssql.

action_name Description request_params
cancelQueryExecution A query execution is cancelled from the SQL editor UI. This does not include cancellations that originate from the Query History UI or Databricks SQL Execution API.
  • queryExecutionId: Only emitted when the legacy SQL editor is used.
  • query_id: Only emitted when the new SQL editor is used.
changeEndpointAcls A warehouse manager updates permissions on a SQL warehouse.
  • aclPermissionSet
  • resourceId
  • shardName
  • targetUserId
cloneFolderNode A user clones a folder in the workspace browser.
  • dashboardId
commandFinish Only in verbose audit logs. Generated when a command on a SQL warehouse completes or is canceled, regardless of the origin of the cancellation request.
  • warehouseId
  • commandId
commandSubmit Only in verbose audit logs. Generated when a command is submitted to a SQL warehouse, regardless of origin of the request.
  • warehouseId
  • commandId
  • validation
  • commandText
  • commandParameters
createAlert A user creates a legacy alert.
  • alertId
  • queryId
createQuery A user creates a new query.
  • queryId
getQuery A user opens a query in SQL editor page or calls the Databricks SQL Get a query API. Only emitted when the legacy SQL editor or Databricks SQL REST API is used.
  • queryId
createQueryDraft A user creates a query draft. Only emitted when the legacy SQL editor is used.
  • queryId
createQuerySnippet A user creates a query snippet.
  • querySnippetId
createVisualization A user generates a visualization using the SQL editor. Excludes default results tables and visualizations in notebooks that utilize SQL warehouses. Only emitted when the legacy SQL editor is used.
  • queryId
  • visualizationId
createWarehouse A user with the cluster create entitlement creates a SQL warehouse.
  • auto_resume
  • auto_stop_mins
  • channel
  • warehouse_type
  • cluster_size
  • conf_pairs
  • custom_cluster_confs
  • enable_databricks_compute
  • enable_photon
  • enable_serverless_compute
  • instance_profile_arn
  • max_num_clusters
  • min_num_clusters
  • name
  • size
  • spot_instance_policy
  • tags
  • test_overrides
deleteAlert A user deletes a legacy alert through the API. Excludes deletions from the file browser UI or from the legacy alert interface.
  • alertId
deleteNotificationDestination A workspace admin deletes a notification destination.
  • notificationDestinationId
deleteWarehouse A warehouse manager deletes a SQL warehouse.
  • id
deleteQuery A user deletes a query, either from the query interface or through API. Excludes deletion via the file browser UI.
  • queryId
deleteQueryDraft A user deletes a query draft. Only emitted when the legacy SQL editor is used.
  • queryId
deleteQuerySnippet A user deletes a query snippet.
  • querySnippetId
deleteVisualization A user deletes a visualization from a query in the SQL Editor. Only emitted when the legacy SQL editor is used.
  • visualizationId
downloadQueryResult A user downloads a query result from the SQL Editor. Excludes downloads from dashboards.
  • fileType
  • queryId
  • queryResultId: Only emitted when the legacy SQL editor is used.
  • credentialsEmbedded
  • credentialsEmbeddedId
editWarehouse A warehouse manager makes edits to a SQL warehouse.
  • auto_stop_mins
  • channel
  • warehouse_type
  • cluster_size
  • confs
  • enable_photon
  • enable_serverless_compute
  • id
  • instance_profile_arn
  • max_num_clusters
  • min_num_clusters
  • name
  • spot_instance_policy
  • tags
executeAdhocQuery Generated by one of the following:
  • A user runs a query draft in the SQL editor
  • A query is executed from a visualization aggregation
  • A user loads a dashboard and executes underlying queries
  • dataSourceId: Only emitted when the legacy SQL editor is used. Equivalent to the SQL warehouse ID.
  • warehouse_id: Only emitted when the new SQL editor is used.
  • query_id: Only emitted when the new SQL editor is used. Corresponds to the current query text in the new SQL editor, which may be equivalent to the original saved query.
executeSavedQuery A user runs a saved query. Only emitted when the legacy SQL editor is used.
  • queryId
favoriteQuery A user favorites a query.
  • queryId
forkQuery A user clones a query.
  • originalQueryId
  • queryId
getAlert A user opens a legacy alert's details page or calls the legacy get alert API.
  • id: ID of the alert
getHistoryQueriesByLookupKeys A user gets details for one or more query executions using lookup keys.
  • lookup_keys
  • include_metrics
getHistoryQuery A user gets details for a query execution using the UI.
  • id
  • queryId
  • include_metrics
  • include_plans
  • include_json_plans
listHistoryQueries A user opens the query history page or calls the Query History List Queries API.
  • filter_by
  • include_metrics
  • max_results
  • page_token
  • order_by
moveAlertToTrash A user moves an legacy alert to the trash using the API. Excludes deletions from the file browser UI or from the legacy alert interface.
  • alertId
moveQueryToTrash A user moves a query to the trash.
  • queryId
  • treestoreId: Only emitted when the new SQL editor is used and a valid queryId cannot be returned.
restoreAlert A user restores a legacy alert from the trash.
  • alertId
restoreQuery A user restores a query from the trash.
  • queryId
setWarehouseConfig A workspace admin updates their workspace's SQL warehouse settings, including configuration parameters and data access properties.
  • data_access_config
  • enable_serverless_compute
  • instance_profile_arn
  • security_policy
  • serverless_agreement
  • sql_configuration_parameters
startWarehouse A SQL warehouse is started.
  • id
stopWarehouse A warehouse manager stops a SQL warehouse. Excludes autostopped warehouses.
  • id
transferObjectOwnership A workspace admin transfers the ownership of a dashboard, query, or legacy alert to an active user through the transfer object ownership API. Ownership transfer done through the UI or update APIs is not captured by this audit log event.
  • newOwner
  • objectId
  • objectType
unfavoriteQuery A user removes a query from their favorites.
  • queryId
updateAlert A user makes updates to a legacy alert. ownerUserName is populated if the legacy alert ownership is transferred using the API.
  • alertId
  • queryId
  • ownerUserName
updateNotificationDestination A workspace admin makes an update to a notification destination.
  • notificationDestinationId
updateFolderNode A user updates a folder node in the workspace browser.
  • name
updateOrganizationSetting A workspace admin makes updates to the workspace's SQL settings.
  • has_configured_data_access
  • has_explored_sql_warehouses
  • has_granted_permissions
  • hide_plotly_mode_bar
  • send_email_on_failed_dashboards
  • allow_downloads
updateQuery A user makes an update to a query. ownerUserName is populated if the query ownership is transferred using the API.
  • queryId
  • ownerUserName
updateQueryDraft A user makes an update to a query draft. Only emitted when the legacy SQL editor is used.
  • queryId
updateQuerySnippet A user makes an update to a query snippet.
  • querySnippetId
updateVisualization A user updates a visualization from the SQL Editor. Only emitted when the legacy SQL editor is used.
  • visualizationId

Notebook events

These events are logged at the workspace level. This service includes events related to notebooks.

These events are logged under the service_name of notebook.

action_name Description request_params
attachNotebook A notebook is attached to a cluster. Also emitted when the new SQL editor is attached to a SQL warehouse.
  • path
  • clusterId
  • notebookId
cloneNotebook A user clones a notebook.
  • notebookId
  • path
  • clonedNotebookId
  • destinationPath
createFolder A notebook folder is created.
  • path
createNotebook A notebook is created.
  • notebookId
  • path
deleteFolder A notebook folder is deleted.
  • path
deleteNotebook A notebook is deleted.
  • notebookId
  • notebookName
  • path
deleteRepo A repository is deleted.
  • path
detachNotebook A notebook is detached from a cluster. Also emitted when the new SQL editor is detached from a SQL warehouse.
  • notebookId
  • clusterId
  • path
downloadLargeResults A user downloads query results too large to display in the notebook. Also emitted when the new SQL editor is used to download query results.
  • notebookId
  • notebookFullPath
  • commandId
  • fileType
downloadPreviewResults A user downloads query results from a notebook or the new SQL editor. Also emitted when a user views a previous result in execution history. If the log is from a view, fileType is set to json.
  • notebookId
  • notebookFullPath
  • commandId
  • fileType
  • statementId: Only emitted when a user views a previous result in execution history.
importNotebook A user imports a notebook.
  • path
  • workspaceExportFormat
modifyNotebook A notebook is modified.
  • notebookId
  • path
moveFolder A notebook folder is moved from one location to another.
  • oldPath
  • newPath
  • folderId
moveNotebook A notebook is moved from one location to another.
  • newPath
  • oldPath
  • notebookId
openNotebook A user opens a notebook using the UI.
  • notebookId
  • path
renameFolder A notebook folder is renamed.
  • folderId
  • newName
  • oldName
  • parentPath
renameNotebook A notebook is renamed.
  • newName
  • oldName
  • parentPath
  • notebookId
restoreFolder A deleted folder is restored.
  • path
restoreNotebook A deleted notebook is restored.
  • path
  • notebookId
  • notebookName
restoreRepo A deleted repository is restored.
  • path
runCommand Available when verbose audit logs are enabled. Emitted after Databricks runs a command in a notebook or the new SQL editor. A command corresponds to a cell in a notebook or the query text in the new SQL editor.
executionTime is measured in seconds.
  • notebookId
  • executionTime
  • status
  • commandId
  • commandText
  • commandLanguage
submitCommand Generated when a command is submitted for execution in a notebook or the new SQL editor. A command corresponds to a cell in a notebook or the query text in the new SQL editor.
  • notebookId
  • commandId
  • clusterId
  • commandLanguage
  • commandText (only available when verbose audit logs are enabled)
takeNotebookSnapshot Notebook snapshots are taken when either the job service or mlflow is run.
  • path

Git folder events

These events are logged at the workspace level. This service includes events related to Databricks Git folders. See also gitCredentials.

These events are logged under the service_name of repos.

action_name Description request_params
checkoutBranch A user checks out a branch on the repo.
  • id
  • branch
commitAndPush A user commits and pushes to a repo.
  • id
  • message
  • files
  • checkSensitiveToken
createRepo A user creates a repo in the workspace
  • url
  • provider
  • path
deleteRepo A user deletes a repo.
  • id
discard A user discards a commit to a repo.
  • id
  • file_paths
getRepo A user makes a call to get information about a single repo.
  • id
listRepos A user makes a call to get all repos they have Manage permissions on.
  • path_prefix
  • next_page_token
pull A user pulls the latest commits from a repo.
  • id
updateRepo A user updates the repo to a different branch or tag, or to the latest commit on the same branch.
  • id
  • branch
  • tag
  • git_url
  • git_provider

Git credential events

These events are logged at the workspace level. This service includes events related to Git credentials for Databricks Git folders.

These events are logged under the service_name of gitCredentials.

action_name Description request_params
createGitCredential A user creates a git credential.
  • git_provider
  • git_username
deleteGitCredential A user deletes a git credential.
  • id
getGitCredential A user gets a git credentials.
  • id
linkGitProvider A user links a git provider.
  • git_provider
  • principal_id
listGitCredentials A user lists all git credentials
  • principal_id
updateGitCredential A user updates a git credential.
  • id
  • git_provider
  • git_username

Global init scripts events

These events are logged at the workspace level. This service includes events related global init scripts.

These events are logged under the service_name of globalInitScripts.

action_name Description request_params
batch-reorder A workspace admin reorders global initialization scripts.
  • script_ids
create A workspace admin creates a global initialization script.
  • name
  • position
  • script-SHA256
  • enabled
update A workspace admin updates a global initialization script.
  • script_id
  • name
  • position
  • script-SHA256
  • enabled
delete A workspace admin deletes a global initialization script.
  • script_id

Remote history service events

These events are logged at the workspace level. This service includes events related to adding and removing GitHub Credentials.

These events are logged under the service_name of RemoteHistoryService.

action_name Description request_params
addUserGitHubCredentials User adds Github Credentials none
deleteUserGitHubCredentials User removes Github Credentials none
updateUserGitHubCredentials User updates Github Credentials none

Workspace events

These events are logged at the workspace level. This service includes events related to workspace management.

These events are logged under the service_name of workspace.

action_name Description request_params
addPermissionAssignment An account admin adds a principal to a workspace.
  • principal_id
  • account_id
  • workspace_id
changeWorkspaceAcl Permissions to the workspace are changed.
  • shardName
  • targetUserId
  • aclPermissionSet
  • resourceId
deletePermissionAssignment A workspace admin removes a principal from a workspace.
  • principal_id
  • account_id
  • workspace_id
deleteSetting A setting is deleted from the workspace.
  • settingKeyTypeName
  • settingKeyName
  • settingTypeName
  • settingName
fileCreate User creates a file in the workspace.
  • path
fileDelete User deletes a file in the workspace.
  • path
fileEditorOpenEvent User opens the file editor.
  • notebookId
  • path
getPermissionAssignment An account admin gets a workspace's permission assignments.
  • account_id
  • workspace_id
getRoleAssignment User gets a workspace's user roles.
  • account_id
  • workspace_id
mintOAuthAuthorizationCode Recorded when in-house OAuth authorization code is minted at the workspace level.
  • client_id
mintOAuthToken OAuth token is minted for workspace.
  • grant_type
  • scope
  • expires_in
  • client_id
moveWorkspaceNode A workspace admin moves workspace node.
  • destinationPath
  • path
purgeWorkspaceNodes A workspace admin purges workspace nodes.
  • treestoreId
reattachHomeFolder An existing home folder is re-attached for a user that is re-added to the workspace.
  • path
renameWorkspaceNode A workspace admin renames workspace nodes.
  • path
  • destinationPath
unmarkHomeFolder Home folder special attributes are removed when a user is removed from the workspace.
  • path
updateRoleAssignment A workspace admin updates a workspace user's role.
  • account_id
  • workspace_id
  • principal_id
  • role
updatePermissionAssignment A workspace admin adds a principal to the workspace.
  • principal_id
  • permissions
setSetting A workspace admin configures a workspace setting.
  • settingKeyTypeName
  • settingKeyName
  • settingTypeName
  • settingName
  • settingValueForAudit
workspaceConfEdit Workspace admin makes updates to a setting, for example enabling verbose audit logs.
  • workspaceConfKeys
  • workspaceConfValues
workspaceExport User exports a notebook from a workspace.
  • workspaceExportDirectDownload
  • workspaceExportFormat
  • notebookFullPath
workspaceInHouseOAuthClientAuthentication OAuth client is authenticated in workspace service.
  • user

Secrets events

These events are logged at the workspace level. This service includes events related to secrets.

These events are logged under the service_name of secrets.

action_name Description request_params
createScope User creates a secret scope.
  • scope
  • initial_manage_principal
  • scope_backend_type
deleteAcl User deletes ACLs for a secret scope.
  • scope
  • principal
deleteScope User deletes a secret scope.
  • scope
deleteSecret User deletes a secret from a scope.
  • key
  • scope
getAcl User gets ACLs for a secret scope.
  • scope
  • principal
getSecret User gets a secret from a scope.
  • key
  • scope
listAcls User makes a call to list ACLs for a secret scope.
  • scope
listScopes User makes a call to list secret scopes none
listSecrets User makes a call to list secrets within a scope.
  • scope
putAcl User changes ACLs for a secret scope.
  • scope
  • principal
  • permission
putSecret User adds or edits a secret within a scope.
  • string_value
  • key
  • scope

SSH events

These events are logged at the workspace level. This service includes events related to SSH access.

These events are logged under the service_name of ssh.

action_name Description request_params
login Agent login of SSH into Spark driver.
  • containerId
  • userName
  • port
  • publicKey
  • instanceId
logout Agent logout of SSH from Spark driver.
  • userName
  • containerId
  • instanceId

Web terminal events

These events are logged at the workspace level. This service includes events related to the web terminal feature.

These events are logged under the service_name of webTerminal.

action_name Description request_params
startSession User starts a web terminal sessions.
  • socketGUID
  • clusterId
  • serverPort
  • ProxyTargetURI
closeSession User closes a web terminal session.
  • socketGUID
  • clusterId
  • serverPort
  • ProxyTargetURI

Databricks Apps events

These events are logged at the workspace level. This service includes events related to Databricks Apps.

These events are logged under the service_name of apps.

action_name Description request_params
createApp A user creates a custom app using the Apps UI or API.
  • app
installTemplateApp A user installs a template app using the Apps UI or API.
  • app
updateApp A user updates an app using the Apps UI or API.
  • app
startApp A user starts the app compute using the Apps UI or API.
  • name
stopApp A user stops the app compute using the Apps UI or API.
  • name
deployApp A user deploys an app using the Apps UI or API.
  • app_deployment
deleteApp A user deletes an app using the Apps UI or API.
  • name
changeAppsAcl A user updates an app's access using the Apps UI or API.
  • request_object_type
  • request_object_id
  • access_control_list

Marketplace consumer events

These events are logged at the workspace level. This service includes events related to consumer actions in Databricks Marketplace.

These events are logged under the service_name of marketplaceConsumer.

action_name Description request_params
getDataProduct A user gets access to a data product through the Databricks Marketplace.
  • listing_id
  • listing_name
  • share_name
  • catalog_name
  • request_context: Array of information about the account and metastore that got access to the data product
requestDataProduct A user requests access to a data product that requires provider approval.
  • listing_id
  • listing_name
  • catalog_name
  • request_context: Array of information about the account and metastore requesting access to the data product

Marketplace provider events

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

These events are logged at the workspace level. This service includes events related to provider actions in Databricks Marketplace.

These events are logged under the service_name of marketplaceProvider.

action_name Description request_params
createListing A metastore admin creates a listing in their provider profile.
  • listing: Array of details about the listing
  • request_context: Array of information about the provider's account and metastore
updateListing A metastore admin makes an update to a listing in their provider profile.
  • id
  • listing: Array of details about the listing
  • request_context: Array of information about the provider's account and metastore
deleteListing A metastore admin deletes a listing in their provider profile.
  • id
  • request_context: Array of details about the provider's account and metastore
updateConsumerRequestStatus A metastore admins approves or denies a data product request.
  • listing_id
  • request_id
  • status
  • reason
  • share: Array of information about the share
  • request_context: Array of information about the provider's account and metastore
createProviderProfile A metastore admin creates a provider profile.
  • provider: Array of information about the provider
  • request_context: Array of information about the provider's account and metastore
updateProviderProfile A metastore admin makes an update to their provider profile.
  • id
  • provider: Array of information about the provider
  • request_context: Array of information about the provider's account and metastore
deleteProviderProfile A metastore admin deletes their provider profile.
  • id
  • request_context: Array of information about the provider's account and metastore
uploadFile A provider uploads a file to their provider profile.
  • request_context: Array of information about the provider's account and metastore
  • marketplace_file_type
  • display_name
  • mime_type
  • file_parent: Array of file parent details
deleteFile A provider deletes a file from their provider profile.
  • file_id
  • request_context: Array of information about the provider's account and metastore

Webhook events

These events are logged at the workspace level. This service includes events related to notification destinations.

These events are logged under the service_name of webhookNotifications.

action_name Description request_params
createWebhook An admin creates a new notification destination.
  • name
  • options
  • type
deleteWebhook An admin deletes a notification destination.
  • id
getWebhook A user views information about a notification destination using the UI or API.
  • id
notifyWebhook A webhook is triggered and sends a notification payload to the target URL.
  • body
  • id
testWebhook A test payload is sent to a webhook URL to verify the configuration and ensure it can receive notifications successfully.
  • id
updateWebhook An admin updates a notification destination.
  • name
  • options
  • type

Partner Connect events

These events are logged at the workspace level. This service includes events related to Partner Connect.

These events are logged under the service_name of partnerHub.

action_name Description request_params
createOrReusePartnerConnection A workspace admin sets up a connection to a partner solution.
  • partner_name
deletePartnerConnection A workspace admin deletes a partner connection.
  • partner_name
downloadPartnerConnectionFile A workspace admin downloads the partner connection file.
  • partner_name
setupResourcesForPartnerConnection A workspace admin sets up resources for a partner connection.
  • partner_name

Genie events

These events are logged at the workspace level. This service includes events related to remote workspace access by support personnel.

Note

This service is unrelated to Genie Spaces. See Genie Space events.

These events are logged under the service_name of genie.

action_name Description request_params
databricksAccess A Databricks personnel is authorized to access a customer environment.
  • duration
  • approver
  • reason
  • authType
  • user

Account-level services

The following services log audit events at the account level.

Account access control events

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

These events are logged at the account level and are related to the Account Access Control API (Public Preview).

These events are logged under the service_name of accountsAccessControl.

action_name Description request_params
updateRuleSet A user updates a rule set using the Account Access Control API.
  • account_id
  • name: Name of the rule set
  • rule_set
  • authz_identity

Federation policy events

These events are logged at the account level and are related to federation policies.

These events are logged under the service_name of accounts.

action_name Description request_params
createFederationPolicy An account admin creates an account or service principal federation policy.
  • policy_id
  • service_principal_id (optional)
deleteFederationPolicy An account admin deletes an account or service principal federation policy.
  • policy_id
  • service_principal_id (optional)
updateFederationPolicy An account admin updates an account or service principal federation policy.
  • policy_id
  • service_principal_id (optional)

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

These events are logged at the account level. This service includes events related to account-level management.

Account-level authentication events

These events are related to account console authentication.

These events are logged under the service_name of accounts.

action_name Description request_params
accountInHouseOAuthClientAuthentication An OAuth client is authenticated.
  • endpoint
  • user: logged as an email address
  • authenticationMethod
accountLoginCodeAuthentication A user's account login code is authenticated.
  • user
accountlessToAccountLoginAuthentication A user logs in through the accountless-to-account upgrade flow.
  • user
  • authenticationMethod
deletePasskeyCredential A user deletes a passkey credential.
  • credential_id
deleteTotpCredential A user deletes a TOTP authenticator app setup key.
login A user logs into the account console.
  • user
  • authenticationMethod
logout A user logs out of the account console.
  • user
mfaLogin A user logs in to the account console using multi-factor authentication.
  • user
  • authenticationMethod
mintOAuthAuthorizationCode Recorded when in-house OAuth authorization code is minted at the account level.
  • client_id
mintOAuthToken An account-level OAuth token is issued to the service principal.
  • grant_type
  • scope
  • expires_in
  • client_id
multiFactorAuthenticationLogin A user logs in to the account console using multi-factor authentication.
  • user
  • authenticationMethod
multiFactorAuthenticationUpdateUserAuthPolicy A user's multi-factor authentication policy is updated.
  • user_mfa_state
  • user_id
oidcBrowserLogin A user logs into their account with the OpenID Connect browser workflow.
  • user
oidcTokenAuthorization An OIDC token is authenticated for an account admin login.
  • user
  • authenticationMethod
registerPasskeyCredential A user registers a passkey credential for multi-factor authentication.
registerTotpCredential A user registers a TOTP authenticator app credential for multi-factor authentication.
skipRegistration A user skips multi-factor authentication registration.
tokenLogin A user logs into Databricks using a token.
  • tokenId
  • user
  • authenticationMethod

Account-level user and group management events

These events are related to account-level user and group management.

These events are logged under the service_name of accounts.

action_name Description request_params
activateUser A user is reactivated after being deactivated. See Deactivate users in account.
  • targetUserName
  • endpoint
  • targetUserId
add A user is added to the Azure Databricks account.
  • targetUserName
  • endpoint
  • targetUserId
addPrincipalToGroup A user is added to an account-level group.
  • targetGroupId
  • endpoint
  • targetUserId
  • targetGroupName
  • groupMembershipType
  • targetUserName
addPrincipalsToGroup Users are added to an account-level group using SCIM provisioning.
  • targetGroupId
  • endpoint
  • targetUserId
  • targetGroupName
  • groupMembershipType
  • targetUserName
createGroup An account-level group is created.
  • endpoint
  • targetGroupId
  • targetGroupName
deactivateUser A user is deactivated. See Deactivate users in account.
  • targetUserName
  • endpoint
  • targetUserId
delete A user is deleted from the Azure Databricks account.
  • targetUserId
  • targetUserName
  • endpoint
removeAccountAdmin An account admin removes account admin permissions from another user.
  • targetUserName
  • endpoint
  • targetUserId
removeGroup A group is removed from the account.
  • targetGroupId
  • targetGroupName
  • endpoint
removePrincipalFromGroup A user is removed from an account-level group.
  • targetGroupId
  • endpoint
  • targetUserId
  • targetGroupName
  • groupMembershipType
  • targetUserName
removePrincipalsFromGroup Users are removed from an account-level group using SCIM provisioning.
  • targetGroupId
  • endpoint
  • targetUserId
  • targetGroupName
  • targetUserName
setAccountAdmin An account admin assigns the account admin role to another user.
  • targetUserName
  • endpoint
  • targetUserId
updateGroup An account admin updates an account-level group.
  • endpoint
  • targetGroupId
  • targetGroupName
updateUser An account admin updates a user account.
  • targetUserName
  • endpoint
  • targetUserId
  • targetUserExternalId
usernameDomainDenied A user sign-up attempt is denied because the email domain is not allowed.
  • targetUserName
validateEmail When a user validates their email after account creation.
  • endpoint
  • targetUserName
  • targetUserId

Account-level token and settings events

These events are related to token management and account settings.

These events are logged under the service_name of accounts.

action_name Description request_params
accountIpAclsValidationFailed IP permissions validation fails. Returns statusCode 403.
  • sourceIpAddress
  • user: logged as an email address
deleteSetting Account admin removes a setting from the Azure Databricks account.
  • settingKeyTypeName
  • settingKeyName
  • settingTypeName
  • settingName
  • settingValueForAudit
garbageCollectDbToken A user runs a garbage collect command on expired tokens.
  • tokenExpirationTime
  • tokenClientId
  • userId
  • tokenCreationTime
  • tokenFirstAccessed
  • tokenHash
generateDbToken User generates a token from User Settings or when the service generates the token.
  • tokenExpirationTime
  • tokenCreatedBy
  • tokenHash
  • userId
setSetting An account admin updates an account-level setting.
  • settingKeyTypeName
  • settingKeyName
  • settingTypeName
  • settingName
  • settingValueForAudit

Service principal credentials events

These events are logged at the account level. These events are related to service credentials.

These events are logged under the service_name of servicePrincipalCredentials.

action_name Description request_params
create Account admin generates an OAuth secret for the service principal.
  • account_id
  • service_principal
  • secret_id
  • lifetime
list Account admin lists all OAuth secrets under a service principal.
  • account_id
  • service_principal
delete Account admin deletes a service principal's OAuth secret.
  • account_id
  • service_principal
  • secret_id

Account provisioning events

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

These events are logged at the account level. These events have to do with cloud configurations made by account admins in the account console.

Network configuration events

These events are related to network configuration, including network connectivity and network policies.

These events are logged under the service_name of accountsManager.

action_name Description request_params
createNetworkConnectivityConfig Account admin created a network connectivity configuration.
  • network_connectivity_config
  • account_id
getNetworkConnectivityConfig Account admin requests details about a network connectivity configuration.
  • account_id
  • network_connectivity_config_id
listNetworkConnectivityConfigs Account admin lists all network connectivity configurations in the account.
  • account_id
deleteNetworkConnectivityConfig Account admin deleted a network connectivity configuration.
  • account_id
  • network_connectivity_config_id
createNetworkConnectivityConfigPrivateEndpointRule Account admin created a private endpoint rule.
  • account_id
  • network_connectivity_config_id
  • azure_private_endpoint_rule
getNetworkConnectivityConfigPrivateEndpointRule Account admin requests details about a private endpoint rule.
  • account_id
  • network_connectivity_config_id
  • rule_id
listNetworkConnectivityConfigPrivateEndpointRules Account admin lists all private endpoint rules under a network connectivity config.
  • account_id
  • network_connectivity_config_id
  • page_token
deleteNetworkConnectivityConfigPrivateEndpointRule Account admin deleted a private endpoint rule.
  • account_id
  • network_connectivity_config_id
  • rule_id
updateNetworkConnectivityConfigPrivateEndpointRule Account admin updated a private endpoint rule.
  • account_id
  • network_connectivity_config_id
  • rule_id
  • azure_private_endpoint_rule
createEndpoint Account admin created an inbound PrivateLink endpoint for performance-intensive services.
  • account_id
  • endpoint
getEndpoint Account admin retrieved details for an inbound PrivateLink endpoint for performance-intensive services.
  • account_id
  • endpoint_id
listEndpoints Account admin listed all inbound PrivateLink endpoints for performance-intensive services in the account.
  • account_id
deleteEndpoint Account admin deleted an inbound PrivateLink endpoint for performance-intensive services.
  • account_id
  • endpoint_id
createNetworkPolicy Account admin created a network policy.
  • account_id
  • network_policy
getNetworkPolicy Account admin requests details about a network policy.
  • account_id
  • network_policy_id
listNetworkPolicies Account admin lists all network policies in the account.
  • account_id
updateNetworkPolicy Account admin updated a network policy.
  • account_id
  • network_policy_id
deleteNetworkPolicy Account admin deleted a network policy.
  • account_id
  • network_policy_id
getWorkspaceNetworkOption Account admin requests details about a workspace's network policies.
  • account_id
  • workspace_id
updateWorkspaceNetworkOption Account admin updated a workspace's network policy.
  • account_id
  • workspace_id

Billable usage events

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

These events are logged at the account level. This service includes events related to billable usage access in the account console.

These events are logged under the service_name of accountBillableUsage.

action_name Description request_params
getAggregatedUsage User accessed aggregated billable usage (usage per day) for the account via the Usage Graph feature.
  • account_id
  • window_size
  • start_time
  • end_time
  • meter_name
  • workspace_ids_filter
getDetailedUsage User accessed detailed billable usage (usage for each cluster) for the account via the Usage Download feature.
  • account_id
  • start_month
  • end_month
  • with_pii

Serverless budget policy events

These events are logged at the account level and are related to serverless budget policies. See Attribute usage with serverless usage policies.

These events are logged under the service_name of budgetPolicyCentral.

action_name Description request_params
createBudgetPolicy Workspace admin or billing admin creates a serverless budget policy. The new policy_id is logged in the response column.
  • policy_name
updateBudgetPolicy Workspace admin, billing admin, or policy manager updates a serverless budget policy.
  • policy.policy_id
  • policy.policy_name
deleteBudgetPolicy Workspace admin, billing admin, or policy manager deletes a serverless budget policy.
  • policy_id

Unity Catalog events

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

The following diagnostic events are related to Unity Catalog. Delta Sharing events are also logged under the unityCatalog service. For Delta Sharing events, see Delta Sharing events. Unity Catalog audit events can be logged at the workspace level or account level depending on the event.

These events are logged under the service_name of unityCatalog.

action_name Description request_params
createMetastore Account admin creates a metastore.
  • name
  • storage_root
  • workspace_id
  • metastore_id
getMetastore Account admin requests metastore ID.
  • id
  • workspace_id
  • metastore_id
getMetastoreSummary Account admin requests details about a metastore.
  • workspace_id
  • metastore_id
listMetastores Account admin requests a list of all metastores in an account.
  • workspace_id
updateMetastore Account admin makes an update to a metastore.
  • id
  • owner
  • workspace_id
  • metastore_id
deleteMetastore Account admin deletes a metastore.
  • id
  • force
  • workspace_id
  • metastore_id
updateMetastoreAssignment Account admin makes an update to a metastore's workspace assignment.
  • workspace_id
  • metastore_id
  • default_catalog_name
createExternalLocation Account admin creates an external location.
  • name
  • skip_validation
  • url
  • credential_name
  • workspace_id
  • metastore_id
getExternalLocation Account admin requests details about an external location.
  • name_arg
  • include_browse
  • workspace_id
  • metastore_id
listExternalLocations Account admin request list of all external locations in an account.
  • url
  • max_results
  • workspace_id
  • metastore_id
updateExternalLocation Account admin makes an update to an external location.
  • name_arg
  • owner
  • workspace_id
  • metastore_id
deleteExternalLocation Account admin deletes an external location.
  • name_arg
  • force
  • workspace_id
  • metastore_id
createCatalog User creates a catalog.
  • name
  • comment
  • workspace_id
  • metastore_id
deleteCatalog User deletes a catalog.
  • name_arg
  • workspace_id
  • metastore_id
getCatalog User requests details about a catalog.
  • name_arg
  • dependent
  • workspace_id
  • metastore_id
updateCatalog User updates a catalog.
  • name_arg
  • isolation_mode
  • comment
  • workspace_id
  • metastore_id
listCatalog User makes a call to list all catalogs in the metastore.
  • name_arg
  • workspace_id
  • metastore_id
createSchema User creates a schema.
  • name
  • catalog_name
  • comment
  • workspace_id
  • metastore_id
deleteSchema User deletes a schema.
  • full_name_arg
  • force
  • workspace_id
  • metastore_id
getSchema User requests details about a schema.
  • full_name_arg
  • dependent
  • workspace_id
  • metastore_id
listSchema User requests a list of all schemas in a catalog.
  • catalog_name
updateSchema User updates a schema.
  • full_name_arg
  • name
  • workspace_id
  • metastore_id
  • comment
createStagingTable
  • name
  • catalog_name
  • schema_name
  • workspace_id
  • metastore_id
createTable User creates a table. The request parameters differ depending on the type of table created.
  • name
  • data_source_format
  • catalog_name
  • schema_name
  • storage_location
  • columns
  • dry_run
  • table_type
  • view_dependencies
  • view_definition
  • sql_path
  • comment
deleteTable User deletes a table.
  • full_name_arg
  • workspace_id
  • metastore_id
getTable User requests details about a table.
  • include_delta_metadata
  • full_name_arg
  • dependent
  • workspace_id
  • metastore_id
privilegedGetTable
  • full_name_arg
listTables User makes a call to list all tables in a schema.
  • catalog_name
  • schema_name
  • workspace_id
  • metastore_id
  • include_browse
listTableSummaries User gets an array of summaries for tables for a schema and catalog within the metastore.
  • catalog_name
  • schema_name_pattern
  • workspace_id
  • metastore_id
updateTables User makes an update to a table. The request parameters displayed vary depending on the type of table updates made.
  • full_name_arg
  • table_type
  • table_constraint_list
  • data_source_format
  • columns
  • dependent
  • row_filter
  • storage_location
  • sql_path
  • view_definition
  • view_dependencies
  • owner
  • comment
  • workspace_id
  • metastore_id
createStorageCredential Account admin creates a storage credential. You might see an additional request parameter based on your cloud provider credentials.
  • name
  • comment
  • workspace_id
  • metastore_id
listStorageCredentials Account admin makes a call to list all storage credentials in the account.
  • workspace_id
  • metastore_id
getStorageCredential Account admin requests details about a storage credential.
  • name_arg
  • workspace_id
  • metastore_id
updateStorageCredential Account admin makes an update to a storage credential.
  • name_arg
  • owner
  • workspace_id
  • metastore_id
deleteStorageCredential Account admin deletes a storage credential.
  • name_arg
  • workspace_id
  • metastore_id
generateTemporaryTableCredential Logged whenever a temporary credential is granted for a table. You can use this event to determine who queried what and when.
  • credential_id
  • credential_type
  • credential_kind
  • is_permissions_enforcing_client
  • table_full_name
  • operation
  • table_id
  • workspace_id
  • table_url
  • metastore_id
generateTemporaryPathCredential Logged whenever a temporary credential is granted for a path.
  • url
  • operation
  • make_path_only_parent
  • credential_kind
  • fallback_enabled
  • workspace_id
  • metastore_id
checkPathAccess Logged whenever user permissions are checked for a given path.
  • path
  • fallback_enabled
getPermissions User makes a call to get permission details for a securable object. This call doesn't return inherited permissions, only explicitly assigned permissions.
  • securable_type
  • securable_full_name
  • workspace_id
  • metastore_id
getEffectivePermissions User makes a call to get all permission details for a securable object. An effective permissions call returns both explicitly assigned and inherited permissions.
  • securable_type
  • securable_full_name
  • workspace_id
  • metastore_id
updatePermissions User updates permissions on a securable object.
  • securable_type
  • changes
  • securable_full_name
  • workspace_id
  • metastore_id
metadataSnapshot User queries the metadata from a previous table version.
  • securables
  • include_delta_metadata
  • workspace_id
  • metastore_id
metadataAndPermissionsSnapshot User queries the metadata and permissions from a previous table version.
  • securables
  • include_delta_metadata
  • workspace_id
  • metastore_id
updateMetadataSnapshot User updates the metadata from a previous table version.
  • table_list_snapshots
  • schema_list_snapshots
  • workspace_id
  • metastore_id
getForeignCredentials User makes a call to get details about a foreign table.
  • securables
  • workspace_id
  • metastore_id
getInformationSchema User makes a call to get details about a schema.
  • table_name
  • page_token
  • required_column_names
  • row_set_type
  • required_column_names
  • workspace_id
  • metastore_id
createConstraint User creates a constraint for a table.
  • full_name_arg
  • constraint
  • workspace_id
  • metastore_id
deleteConstraint User deletes a constraint for a table.
  • full_name_arg
  • constraint
  • workspace_id
  • metastore_id
createPipeline User creates a Unity Catalog pipeline.
  • target_catalog_name
  • has_workspace_definition
  • id
  • workspace_id
  • metastore_id
updatePipeline User updates a Unity Catalog pipeline.
  • id_arg
  • definition_json
  • id
  • workspace_id
  • metastore_id
getPipeline User requests details about a Unity Catalog pipeline.
  • id
  • workspace_id
  • metastore_id
deletePipeline User deletes a Unity Catalog pipeline.
  • id
  • workspace_id
  • metastore_id
deleteResourceFailure Resource fails to delete none
createVolume User creates a Unity Catalog volume.
  • name
  • catalog_name
  • schema_name
  • volume_type
  • storage_location
  • owner
  • comment
  • workspace_id
  • metastore_id
getVolume User makes a call to get information on a Unity Catalog volume.
  • volume_full_name
  • workspace_id
  • metastore_id
updateVolume User updates a Unity Catalog volume's metadata with the ALTER VOLUME or COMMENT ON calls.
  • volume_full_name
  • name
  • owner
  • comment
  • workspace_id
  • metastore_id
deleteVolume User deletes a Unity Catalog volume.
  • volume_full_name
  • workspace_id
  • metastore_id
listVolumes User makes a call to get a list of all Unity Catalog volumes in a schema.
  • catalog_name
  • schema_name
  • workspace_id
  • metastore_id
generateTemporaryVolumeCredential A temporary credential is granted for a volume.
  • volume_id
  • volume_full_name
  • operation
  • volume_storage_location
  • credential_id
  • credential_type
  • credential_kind
  • workspace_id
  • metastore_id
getTagSecurableAssignments Tag assignments for a securable are fetched
  • securable_type
  • securable_full_name
  • workspace_id
  • metastore_id
getTagSubentityAssignments Tag assignments for a subentity are fetched
  • securable_type
  • securable_full_name
  • workspace_id
  • metastore_id
  • subentity_name
UpdateTagSecurableAssignments Tag assignments for a securable are updated
  • securable_type
  • securable_full_name
  • workspace_id
  • metastore_id
  • changes
UpdateTagSubentityAssignments Tag assignments for a subentity are updated
  • securable_type
  • securable_full_name
  • workspace_id
  • metastore_id
  • subentity_name
  • changes
createRegisteredModel User creates a Unity Catalog registered model.
  • name
  • catalog_name
  • schema_name
  • owner
  • comment
  • workspace_id
  • metastore_id
getRegisteredModel User makes a call to get information on a Unity Catalog registered model.
  • full_name_arg
  • workspace_id
  • metastore_id
updateRegisteredModel User updates a Unity Catalog registered model's metadata.
  • full_name_arg
  • name
  • owner
  • comment
  • workspace_id
  • metastore_id
deleteRegisteredModel User deletes a Unity Catalog registered model.
  • full_name_arg
  • workspace_id
  • metastore_id
listRegisteredModels User makes a call to get a list of Unity Catalog registered models in a schema, or list models across catalogs and schemas.
  • catalog_name
  • schema_name
  • max_results
  • page_token
  • workspace_id
  • metastore_id
createModelVersion User creates a model version in Unity Catalog.
  • catalog_name
  • schema_name
  • model_name
  • source
  • comment
  • workspace_id
  • metastore_id
finalizeModelVersion User makes a call to “finalize” a Unity Catalog model version after uploading model version files to its storage location, making it read-only and usable in inference workflows.
  • full_name_arg
  • version_arg
  • workspace_id
  • metastore_id
getModelVersion User makes a call to get details on a model version.
  • full_name_arg
  • version_arg
  • workspace_id
  • metastore_id
getModelVersionByAlias User makes a call to get details on a model version using the alias.
  • full_name_arg
  • include_aliases
  • alias_arg
  • workspace_id
  • metastore_id
updateModelVersion User updates a model version's metadata.
  • full_name_arg
  • version_arg
  • name
  • owner
  • comment
  • workspace_id
  • metastore_id
deleteModelVersion User deletes a model version.
  • full_name_arg
  • version_arg
  • workspace_id
  • metastore_id
listModelVersions User makes a call to get a list of Unity Catalog model versions in a registered model.
  • catalog_name
  • schema_name
  • model_name
  • max_results
  • page_token
  • workspace_id
  • metastore_id
generateTemporaryModelVersionCredential A temporary credential is generated when a user performs a write (during initial model version creaiton) or read (after the model version has been finalized) on a model version. You can use this event to determine who accessed a model version and when.
  • full_name_arg
  • version_arg
  • operation
  • model_version_url
  • credential_id
  • credential_type
  • credential_kind
  • workspace_id
  • metastore_id
setRegisteredModelAlias User sets an alias on a Unity Catalog registered model.
  • full_name_arg
  • alias_arg
  • version
deleteRegisteredModelAlias User deletes an alias on a Unity Catalog registered model.
  • full_name_arg
  • alias_arg
getModelVersionByAlias User gets a Unity Catalog model version by alias.
  • full_name_arg
  • alias_arg
createConnection A new foreign connection is created.
  • name
  • connection_type
  • workspace_id
  • metastore_id
deleteConnection A foreign connection is deleted.
  • name_arg
  • workspace_id
  • metastore_id
getConnection A foreign connection is retrieved.
  • name_arg
  • workspace_id
  • metastore_id
updateConnection A foreign connection is updated.
  • name_arg
  • owner
  • workspace_id
  • metastore_id
listConnections Foreign connections in a metastore are listed.
  • workspace_id
  • metastore_id
createFunction User creates a new function.
  • function_info
  • workspace_id
  • metastore_id
updateFunction User updates a function.
  • full_name_arg
  • owner
  • workspace_id
  • metastore_id
listFunctions User requests a list of all functions within a specific parent catalog or schema.
  • catalog_name
  • schema_name
  • include_browse
  • workspace_id
  • metastore_id
getFunction User requests a function from a parent catalog or schema.
  • full_name_arg
  • workspace_id
  • metastore_id
deleteFunction User requests a function from a parent catalog or schema.
  • full_name_arg
  • workspace_id
  • metastore_id
generateTemporaryServiceCredential A temporary credential is generated to access a cloud service account from Databricks.
  • credential_id
  • credential_type
  • credential_kind
  • workspace_id
  • metastore_id
UpdateWorkspaceBindings A metastore admin or object owner updates the workspace bindings of a catalog, external location, or storage credential.
  • securable_type
  • securable_full_name
  • add: Only logged when binding is assigned. Includes a list of workspace IDs and the binding type.
  • remove: Only logged when a binding is unassigned. Includes workspace IDs of affected workspaces.
  • workspace_id
  • metastore_id
CreateSecurableTagAssignment A tag assignment is created on a securable.
  • securable_type
  • tag_value
  • securable_full_name
  • workspace_id
  • tag_key
  • metastore_id
CreateSubsecurableTagAssignment A tag assignment is created on a subsecurable.
  • securable_type
  • tag_value
  • subsecurable_name
  • securable_full_name
  • subsecurable_type
  • workspace_id
  • tag_key
  • metastore_id
DeleteSecurableTagAssignment A tag assignment on a securable is deleted.
  • securable_type
  • securable_full_name
  • workspace_id
  • tag_key
  • metastore_id
DeleteSubsecurableTagAssignment A tag assignment on a subsecurable is deleted.
  • securable_type
  • subsecurable_name
  • securable_full_name
  • subsecurable_type
  • workspace_id
  • tag_key
  • metastore_id
ListSecurableTagAssignments A user requests a list of tag assignments on a securable.
  • securable_type
  • securable_full_name
  • workspace_id
  • metastore_id
ListSubsecurableTagAssignments A user requests a list of tag assignments on a subsecurable.
  • securable_type
  • subsecurable_name
  • securable_full_name
  • subsecurable_type
  • workspace_id
  • metastore_id
createEntityTagAssignment A tag assignment is created on a Unity Catalog entity.
  • entity_name
  • entity_type
  • tag_key
  • tag_value
  • workspace_id
  • metastore_id
getEntityTagAssignment A user requests details of a tag assignment on a Unity Catalog entity.
  • entity_name
  • entity_type
  • tag_key
  • include_inherited
  • workspace_id
  • metastore_id
listEntityTagAssignments A user requests a list of tag assignments on a Unity Catalog entity.
  • entity_name
  • entity_type
  • max_results
  • include_inherited
  • workspace_id
  • metastore_id
updateEntityTagAssignment A tag assignment on a Unity Catalog entity is updated.
  • entity_name
  • entity_type
  • tag_key
  • tag_value
  • workspace_id
  • metastore_id
deleteEntityTagAssignment A tag assignment on a Unity Catalog entity is deleted.
  • entity_name
  • entity_type
  • tag_key
  • workspace_id
  • metastore_id
listSecurableTags A user requests a list of tags on a securable.
  • workspace_id
  • metastore_id
createPolicy ABAC policy is created.
  • policy_info
  • workspace_id
  • metastore_id
deletePolicy ABAC policy is deleted.
  • name
  • on_securable_type
  • on_securable_fullname
  • workspace_id
  • metastore_id
getPolicy User requests details about an ABAC policy.
  • name
  • on_securable_type
  • on_securable_fullname
  • workspace_id
  • metastore_id
listPolicies User requests a list of ABAC policies.
  • include_inherited
  • on_securable_type
  • on_securable_fullname
  • max_results
  • workspace_id
  • metastore_id
updatePolicy ABAC policy is updated.
  • name
  • policy_info
  • on_securable_type
  • on_securable_fullname
  • workspace_id
  • metastore_id
GetWorkspaceBindings User requests workspace binding details for a securable object.
  • securable_type
  • securable_full_name
  • max_results
  • workspace_id
  • metastore_id
UpdateCatalogWorkspaceBindings User updates workspace bindings for a catalog.
  • catalog_name
  • assign_workspaces
  • workspace_id
  • metastore_id
createCredential User creates a storage or service credential.
  • name
  • credential_id
  • credential_type
  • purpose
  • comment
  • credential_kind
  • workspace_id
  • metastore_id
deleteCredential User deletes a storage or service credential.
  • name_arg
  • workspace_id
  • metastore_id
getCredential User requests details about a storage or service credential.
  • credential_id
  • name_arg
  • credential_type
  • credential_kind
  • workspace_id
  • metastore_id
listCredentials User requests a list of storage and service credentials.
  • max_results
  • workspace_id
  • metastore_id
updateCredential User updates a storage or service credential.
  • name_arg
  • name
  • owner
  • workspace_id
  • metastore_id
validateCredential User validates a storage or service credential.
  • external_location_name
  • url
  • read_only
  • credential_name
  • workspace_id
  • metastore_id
createStorageLocation User creates a storage location.
  • storage_info
  • workspace_id
  • metastore_id
createMetastoreAssignment Admin assigns a metastore to a workspace.
  • input_workspace_id
  • input_metastore_id
  • metastore_id
deleteMetastoreAssignment Admin removes a metastore assignment from a workspace.
  • input_workspace_id
  • input_metastore_id
  • metastore_id
getCurrentMetastoreAssignment User requests current metastore assignment details.
  • workspace_id
  • metastore_id
enableSystemSchema Admin enables a system schema.
  • schema
  • metastore_id
  • workspace_id
disableSystemSchema Admin disables a system schema.
  • schema
  • metastore_id
  • workspace_id
listSystemSchemas User requests a list of system schemas.
  • metastore_id
  • workspace_id
getQuota User requests details about a resource quota.
  • quota_name
  • parent_full_name
  • parent_securable_type
  • workspace_id
  • metastore_id
listQuotas User requests a list of resource quotas.
  • max_results
  • workspace_id
  • metastore_id
getTableById User requests table details by table ID.
  • table_id
  • workspace_id
  • metastore_id
listDroppedTables User requests a list of dropped tables.
  • catalog_name
  • page_token
  • schema_name
  • max_results
  • workspace_id
  • metastore_id
tableExists User checks if a table exists.
  • full_name_arg
  • dependent
  • workspace_id
  • metastore_id
undropTable User restores a dropped table.
  • full_name_arg
  • workspace_id
  • metastore_id
updateTableToManaged User converts an external table to a managed table.
  • is_rollback_to_external
  • full_name_arg
  • entity_storage_location_id
  • workspace_id
  • metastore_id
listAllVolumesInMetastore User requests a list of all volumes in a metastore.
  • page_token
  • workspace_id
  • metastore_id
getArtifactAllowlist User requests details about the artifact allowlist.
  • artifact_type
  • workspace_id
  • metastore_id
setArtifactAllowlist User updates the artifact allowlist.
  • artifact_matchers
  • artifact_type
  • workspace_id
  • metastore_id
updateMLServingPermissions Service principal is granted permissions to deploy a model.
  • securable_kind
  • securable_type
  • version
  • operation
  • securable_full_name
  • service_principal_id
  • workspace_id
  • metastore_id

Delta Sharing events

Note

This service is unavailable through Azure diagnostic settings. Enable the audit log system table to access these events.

Delta Sharing events are broken up into two sections: events recorded in the data provider's account and events recorded in the data recipient's account.

To learn how to use audit logs to monitor Delta Sharing events, see Audit and monitor data sharing.

Delta Sharing provider events

These audit log events are logged in the provider's account. Actions that are performed by recipients start with the deltaSharing prefix. Each of these logs also includes request_params.metastore_id, which is the metastore that manages the shared data, and userIdentity.email, which is the ID of the user who initiated the activity.

These events are logged under the service_name of unityCatalog.

action_name Description request_params
deltaSharingListShares A data recipient requests a list of shares.
  • options: The pagination options provided with this request.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingGetShare A data recipient requests details about a shares.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingListSchemas A data recipient requests a list of shared schemas.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • options: The pagination options provided with this request.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingListAllTables A data recipient requests a list of all shared tables.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingListTables A data recipient requests a list of shared tables.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • options: The pagination options provided with this request.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingGetTableMetadata A data recipient requests a details about a table's metadata.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • schema: The name of the schema.
  • name: The name of the table.
  • predicateHints: The predicates included in the query.
  • limitHints: The maximum number of rows to return.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingGetTableVersion A data recipient requests a details about a table version.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • schema: The name of the schema.
  • name: The name of the table.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingQueryTable Logged when a data recipient queries a shared table.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • schema: The name of the schema.
  • name: The name of the table.
  • predicateHints: The predicates included in the query.
  • limitHints: The maximum number of rows to return.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingQueryTableChanges Logged when a data recipient queries change data for a table.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • schema: The name of the schema.
  • name: The name of the table.
  • cdf_options: Change data feed options.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingQueriedTable Logged after a data recipient gets a response to their query. The response.result field includes more information on the recipient's query (see Audit and monitor data sharing)
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingQueriedTableChanges Logged after a data recipient gets a response to their query. The response.result field includes more information on the recipient's query (see Audit and monitor data sharing).
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingListNotebookFiles A data recipient requests a list of shared notebook files.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingQueryNotebookFile A data recipient queries a shared notebook file.
  • file_name: The name of the notebook file.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingListFunctions A data recipient requests a list of functions in a parent schema.
  • share: The name of the share.
  • schema: The name of the parent schema of the function.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingListAllFunctions A data recipient requests a list of all shared functions.
  • share: The name of the share.
  • schema: The name of the parent schema of the function.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingListFunctionVersions A data recipient requests a list of function versions.
  • share: The name of the share.
  • schema: The name of the parent schema of the function.
  • function: The name of the function.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingListVolumes A data recipient requests a list of shared volumes in a schema.
  • share: The name of the share.
  • schema: The parents schema of the volumes.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
deltaSharingListAllVolumes A data recipient requests all shared volumes.
  • share: The name of the share.
  • recipient_name: Indicates the recipient executing the action.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
updateMetastore Provider updates their metastore.
  • delta_sharing_scope: Values can be INTERNAL or INTERNAL_AND_EXTERNAL.
  • delta_sharing_recipient_token_lifetime_in_seconds: If present, indicates that the recipient token lifetime was updated.
createRecipient Provider creates a data recipient.
  • name: The name of the recipient.
  • comment: The comment for the recipient.
  • ip_access_list.allowed_ip_addresses: Recipient IP address allowlist.
deleteRecipient Provider deletes a data recipient.
  • name: The name of the recipient.
getRecipient Provider requests details about a data recipient.
  • name: The name of the recipient.
listRecipients Provider requests a list of all their data recipients. none
rotateRecipientToken Provider rotates a recipient's token.
  • name: The name of the recipient.
  • comment: The comment given in the rotation command.
updateRecipient Provider updates a data recipient's attributes.
  • name: The name of the recipient.
  • updates: A JSON representation of recipient attributes that were added or removed from the share.
createShare Provider updates a data recipient's attributes.
  • name: The name of the share.
  • comment: The comment for the share.
deleteShare Provider updates a data recipient's attributes.
  • name: The name of the share.
getShare Provider requests details about a share.
  • name: The name of the share.
  • include_shared_objects: Whether the share's table names were included in the request.
updateShare Provider adds or removes data assets from a share.
  • name: The name of the share.
  • updates: A JSON representation of data assets that were added or removed from the share. Each item includes action (add or remove), name (the actual name of the table), shared_as (the name the asset was shared as, if different from the actual name), and partition_specification (if a partition specification was provided).
listShares Provider requests a list of their shares. none
getSharePermissions Provider requests details on a share's permissions.
  • name: The name of the share.
updateSharePermissions Provider updates a share's permissions.
  • name: The name of the share.
  • changes: A JSON representation of the updated permissions. Each change includes principal (the user or group to whom permission is granted or revoked), add (the list of permissions that were granted), and remove (the list of permissions that were revoked).
getRecipientSharePermissions Provider requests details about a recipient's share permissions.
  • name: The name of the share.
getActivationUrlInfo Provider requests details about activity on their activation link.
  • recipient_name: The name of the recipient who opened the activation URL.
  • is_ip_access_denied: None if there is no IP access list configured. Otherwise, true if the request was denied and false if the request was not denied. sourceIPaddress is the recipient IP address.
generateTemporaryVolumeCredential Temporary credential is generated for the recipient to access a shared volume.
  • share_name: The name of the share through which the recipient requests.
  • share_id: The ID of the share.
  • share_owner: The owner of the share.
  • recipient_name: The name of the recipient who requests the credential.
  • recipient_id: The ID of the recipient.
  • volume_full_name: The full 3-level name of the volume.
  • volume_id: The ID of the volume.
  • volume_storage_location: The cloud path of the volume root.
  • operation: Either READ_VOLUME or WRITE_VOLUME. For volume sharing, only READ_VOLUME is supported.
  • credential_id: The ID of the credential.
  • credential_type: The type of the credential. Value is either StorageCredential or ServiceCredential.
  • credential_kind: The method used to authorize access.
  • workspace_id: Value is always 0 when the request is for shared volumes.
generateTemporaryTableCredential Temporary credential is generated for the recipient to access a shared table.
  • share_name: The name of the share through which the recipient requests.
  • share_id: The ID of the share.
  • share_owner: The owner of the share.
  • recipient_name: The name of the recipient who requests the credential.
  • recipient_id: The ID of the recipient.
  • table_full_name: The full 3-level name of the table.
  • table_id: The ID of the table.
  • table_url: The cloud path of the table root.
  • operation: Either READ or READ_WRITE.
  • credential_id: The ID of the credential.
  • credential_type: The type of the credential. Value is either StorageCredential or ServiceCredential.
  • credential_kind: The method used to authorize access.
  • workspace_id: Value is always 0 when the request is for shared tables.
createRecipientOidcPolicy Provider creates an OIDC federation policy for a recipient.
  • recipient_name
  • policy
deleteRecipientOidcPolicy Provider deletes an OIDC federation policy for a recipient.
  • recipient_name
  • name
  • workspace_id
  • metastore_id
deleteRecipientPolicy Provider deletes a recipient policy.
  • recipient_name
  • name
  • workspace_id
  • metastore_id
getRecipientOidcPolicy Provider requests details about a recipient's OIDC federation policy.
  • recipient_name
  • name
  • workspace_id
  • metastore_id
getRecipientPropertiesByDependentId Provider requests recipient properties for a dependent object.
  • dependent
  • property_keys
  • workspace_id
  • metastore_id
listRecipientOidcPolicies Provider requests a list of OIDC federation policies for a recipient.
  • recipient_name
  • workspace_id
  • metastore_id
reconnectRecipientAccount Provider reconnects a Databricks-to-Databricks recipient account.
  • recipient
  • metastore_id
retrieveRecipientToken Recipient retrieves their bearer token for open sharing authentication.
  • recipient_name
  • is_ip_access_denied
  • metastore_id
deltaSharingGetQueryInfo Provider requests query information for a shared table.
  • name
  • recipient_authentication_type
  • recipient_global_metastore_id
  • recipient_name
  • share_id
  • user_agent
  • is_ip_access_denied
  • share
  • schema
  • query_id
  • share_name
  • recipient_id
  • workspace_id
  • metastore_id
deltaSharingReconciliation Delta Sharing performs reconciliation for a shared table.
  • tableType
  • tableDataSourceFormat
  • tableUrl
  • schemaId
  • tableFullName
  • accountId
  • metastoreId
  • securableId
  • catalogId
  • opType
  • workspace_id
  • metastore_id
addShareToCatalog Recipient mounts a share to a catalog.
  • catalog_name
  • provider_name
  • share_name
  • workspace_id
  • metastore_id
listSharesInCatalog User requests a list of shares mounted in a catalog.
  • catalog_name
  • workspace_id
  • metastore_id
removeShareFromCatalog Recipient unmounts a share from a catalog.
  • catalog_name
  • provider_name
  • share_name
  • workspace_id
  • metastore_id
listProviderShareAssets User requests a list of assets in a provider's share.
  • provider_name_arg
  • share_name_arg
  • workspace_id
  • metastore_id
listInboundSharedNotebookFiles Recipient requests a list of notebook files shared in a catalog.
  • catalog_name
  • workspace_id
  • metastore_id
getInboundSharedNotebookFile Recipient requests details about a shared notebook file.
  • catalog_name
  • notebook_file_name_arg
  • workspace_id
  • metastore_id
listSharedCatalogs Provider requests a list of shared catalogs.
  • provider_ids
  • workspace_id
  • metastore_id

Delta Sharing recipient events

These events are logged in the data recipient's account. These events record recipient access of shared data and AI assets, along with events associated with the management of providers. Each of these events also includes the following request parameters:

  • recipient_name: The name of the recipient in the data provider's system.
  • metastore_id: The name of the metastore in the data provider's system.
  • sourceIPAddress: The IP address where the request originated.

These events are logged under the service_name of unityCatalog.

action_name Description request_params
deltaSharingProxyGetTableVersion A data recipient requests details on a shared table version.
  • share_name: The name of the share.
  • catalog_name: The name of the catalog mounted to the share.
  • schema: The name of the table's parent schema.
  • name: The name of the table.
deltaSharingProxyGetTableMetadata A data recipient requests details on a shared table's metadata.
  • share_name: The name of the share.
  • catalog_name: The name of the catalog mounted to the share.
  • schema: The name of the table's parent schema.
  • name: The name of the table.
deltaSharingProxyQueryTable A data recipient queries a shared table.
  • share_name: The name of the share.
  • catalog_name: The name of the catalog mounted to the share.
  • schema: The name of the table's parent schema.
  • name: The name of the table.
  • limitHints: The maximum number of rows to return.
  • predicateHints: The predicates included in the query.
  • version: Table version, if change data feed is enabled.
deltaSharingProxyQueryTableChanges A data recipient queries change data for a table.
  • share_name: The name of the share.
  • catalog_name: The name of the catalog mounted to the share.
  • schema: The name of the table's parent schema.
  • name: The name of the table.
  • cdf_options: Change data feed options.
createProvider A data recipient creates a provider object.
  • name: The name of the provider.
  • comment: The comment for the provider.
updateProvider A data recipient updates a provider object.
  • name: The name of the provider.
  • updates: A JSON representation of provider attributes that were added or removed from the share. Each item includes action (add or remove) and can include name (the new provider name), owner (new owner), and comment.
deleteProvider A data recipient deletes a provider object.
  • name: The name of the provider.
getProvider A data recipient requests details about a provider object.
  • name: The name of the provider.
listProviders A data recipient requests a list of providers. none
activateProvider A data recipient activates a provider object.
  • name: The name of the provider.
listProviderShares A data recipient requests a list of a provider's shares.
  • name: The name of the provider.

Delta Sharing external Iceberg client events

Important

This feature is in Public Preview.

These events are logged at the account level for external Iceberg clients accessing shared data using the Apache Iceberg REST Catalog API. To learn more, see Enable sharing to external Iceberg clients.

These events are logged when external Iceberg clients (such as Snowflake or other non-Databricks systems) access shared data.

These events are logged under the service_name of dataSharing.

action_name Description request_params
icebergGetConfig An external Iceberg client requests configuration information.
  • recipient_id
  • recipient_name
  • recipient_authentication_type
  • user_agent
  • share_id
  • share_name
  • namespace_name
  • table_name
  • metastore_id
icebergListNamespaces An external Iceberg client requests a list of namespaces.
  • recipient_id
  • recipient_name
  • recipient_authentication_type
  • user_agent
  • share_id
  • share_name
  • namespace_name
  • table_name
  • metastore_id
icebergGetNamespace An external Iceberg client requests details about a namespace.
  • recipient_id
  • recipient_name
  • recipient_authentication_type
  • user_agent
  • share_id
  • share_name
  • namespace_name
  • table_name
  • metastore_id
icebergListTables An external Iceberg client requests a list of tables in a namespace.
  • recipient_id
  • recipient_name
  • recipient_authentication_type
  • user_agent
  • share_id
  • share_name
  • namespace_name
  • table_name
  • metastore_id
icebergLoadTable An external Iceberg client loads table metadata.
  • recipient_id
  • recipient_name
  • recipient_authentication_type
  • user_agent
  • share_id
  • share_name
  • namespace_name
  • table_name
  • metastore_id
icebergReportMetrics An external Iceberg client reports metrics.
  • recipient_id
  • recipient_name
  • recipient_authentication_type
  • user_agent
  • share_id
  • share_name
  • namespace_name
  • table_name
  • metastore_id

Clean Rooms events

These events are logged at the account level. These events are related to Clean Rooms.

These events are logged under the service_name of clean-room.

action_name Description request_params
createCleanRoom A user in your Databricks account creates a new clean room using the UI or API.
  • clean_room_name
  • cloud_vendor
  • collaborators
  • metastore_id
  • region
  • workspace_id
createCleanRoomAsset A user in your account creates a clean room asset.
  • asset
  • clean_room_name
createCleanRoomAssetReview A user in your Databricks account creates a review for a clean room asset using the UI or API. Currently, only notebooks are reviewable.
  • clean_room_name
  • asset_full_name
  • notebook_review
  • asset_type
createCleanRoomAutoApprovalRule A user in your Databricks account creates an auto-approval rule for a clean room using the UI or API. The response includes a rule_id that is referenced in the clean_room_events system table.
  • clean_room_name
  • auto_approval_rule
createCleanRoomOutputCatalog A user in your Databricks account creates an output table in a clean room using the UI or API.
  • clean_room_name
  • output_catalog_name
  • metastore_id
  • workspace_id
deleteCleanRoom A user in your Databricks account deletes a clean room using the UI or API.
  • clean_room_name
  • metastore_id
  • workspace_id
deleteCleanRoomAsset A user in your account deletes a clean room asset.
  • asset_full_name
  • asset_type
  • clean_room_name
deleteCleanRoomAutoApprovalRule A user in your Databricks account deletes an auto-approval rule for a clean room using the UI or API.
  • clean_room_name
  • rule_id
getCleanRoom A user in your account gets details about a clean room using the UI or API.
  • clean_room_name
  • metastore_id
  • workspace_id
getCleanRoomAsset A user in your account views details about a clean room's data asset using the UI.
  • asset_full_name
  • metastore_id
  • workspace_id
  • asset_type
  • clean_room_name
  • collaborator_global_metastore_id
listCleanRoomAssets A user gets a list of assets within a clean room.
  • clean_room_name
listCleanRoomAutoApprovalRules A user in your Databricks account lists auto-approval rules for a clean room using the UI or API.
  • clean_room_name
listCleanRoomNotebookTaskRuns A user gets a list of notebook task runs within a clean room.
  • clean_room_name
  • notebook_name
listCleanRooms A user gets a list of all clean rooms using the workspace UI or all clean rooms in the metastore using the API.
  • metastore_id
  • workspace_id
updateCleanRoom A user in your account updates a clean room's details or assets.
  • added_assets
  • clean_room_name
  • owner
  • metastore_id
  • workspace_id
  • updated_assets
  • removed_assets
updateCleanRoomAsset A user in your account updates a clean room asset.
  • asset
  • clean_room_name

Additional security monitoring events

For Azure Databricks compute resources in the classic compute plane, such as VMs for clusters and pro or classic SQL warehouses, the following features enable additional monitoring agents:

File integrity monitoring events

These events are logged at the workspace level. This service includes events related to file integrity monitoring.

These events are logged under the service_name of capsule8-alerts-dataplane.

action_name Description request_params
Heartbeat A regular event to confirm the monitor is on. Currently runs every 10 minutes.
  • instanceId
Memory Marked Executable Memory is often marked executable in order to allow malicious code to execute when an application is being exploited. Alerts when a program sets heap or stack memory permissions to executable. This can cause false positives for certain application servers.
  • instanceId
File Integrity Monitor Monitors the integrity of important system files. Alerts on any unauthorized changes to those files. Databricks defines specific sets of system paths on the image, and this set of paths might change over time.
  • instanceId
Systemd Unit File Modified Changes to systemd units could result in security controls being relaxed or disabled, or the installation of a malicious service. Alerts whenever a systemd unit file is modified by a program other than systemctl.
  • instanceId
Repeated Program Crashes Repeated program crashes could indicate that an attacker is attempting to exploit a memory corruption vulnerability, or that there is a stability issue in the affected application. Alerts when more than 5 instances of an individual program crash via segmentation fault.
  • instanceId
Userfaultfd Usage As containers are typically static workloads, this alert could indicate that an attacker has compromised the container and is attempting to install and run a backdoor. Alerts when a file that has been created or modified within 30 minutes is then executed within a container.
  • instanceId
New File Executed in Container Memory is often marked executable in order to allow malicious code to execute when an application is being exploited. Alerts when a program sets heap or stack memory permissions to executable. This can cause false positives for certain application servers.
  • instanceId
Suspicious Interactive Shell Interactive shells are rare occurrences on modern production infrastructure. Alerts when an interactive shell is started with arguments commonly used for reverse shells.
  • instanceId
User Command Logging Evasion Evading command logging is common practice for attackers, but might also indicate that a legitimate user is performing unauthorized actions or trying to evade policy. Alerts when a change to user command history logging is detected, indicating that a user is attempting to evade command logging.
  • instanceId
BPF Program Executed Detects some types of kernel backdoors. The loading of a new Berkeley Packet Filter (BPF) program could indicate that an attacker is loading a BPF-based rootkit to gain persistence and avoid detection. Alerts when a process loads a new privileged BPF program, if the process that is already part of an ongoing incident.
  • instanceId
Kernel Module Loaded Attackers commonly load malicious kernel modules (rootkits) to evade detection and maintain persistence on a compromised node. Alerts when a kernel module is loaded, if the program is already part of an ongoing incident.
  • instanceId
Suspicious Program Name Executed-Space After File Attackers might create or rename malicious binaries to include a space at the end of the name in an effort to impersonate a legitimate system program or service. Alerts when a program is executed with a space after the program name.
  • instanceId
Illegal Elevation Of Privileges Kernel privilege escalation exploits commonly enable an unprivileged user to gain root privileges without passing standard gates for privilege changes. Alerts when a program attempts to elevate privileges through unusual means. This can issue false positive alerts on nodes with significant workloads.
  • instanceId
Kernel Exploit Internal kernel functions are not accessible to regular programs, and if called, are a strong indicator that a kernel exploit has executed and that the attacker has full control of the node. Alerts when a kernel function unexpectedly returns to user space.
  • instanceId
Processor-Level Protections Disabled SMEP and SMAP are processor-level protections that increase difficulty for kernel exploits to succeed, and disabling these restrictions is a common early step in kernel exploits. Alerts when a program tampers with the kernel SMEP/SMAP configuration.
  • instanceId
Container Escape via Kernel Exploitation Alerts when a program uses kernel functions commonly used in container escape exploits, indicating that an attacker is escalating privileges from container-access to node-access.
  • instanceId
Privileged Container Launched Privileged containers have direct access to host resources, leading to a greater impact when compromised. Alerts when a privileged container is launched, if the container isn't a known privileged image such as kube-proxy. This can issue unwanted alerts for legitimate privileged containers.
  • instanceId
Userland Container Escape Many container escapes coerce the host to execute an in-container binary, resulting in the attacker gaining full control of the affected node. Alerts when a container-created file is executed from outside a container.
  • instanceId
AppArmor Disabled In Kernel Modification of certain AppArmor attributes can only occur in-kernel, indicating that AppArmor has been disabled by a kernel exploit or rootkit. Alerts when the AppArmor state is changed from the AppArmor configuration detected when the sensor starts.
  • instanceId
AppArmor Profile Modified Attackers might attempt to disable enforcement of AppArmor profiles as part of evading detection. Alerts when a command for modifying an AppArmor profile is executed, if it was not executed by a user in an SSH session.
  • instanceId
Boot Files Modified If not performed by a trusted source (such as a package manager or configuration management tool), modification of boot files could indicate an attacker modifying the kernel or its options in order to gain persistent access to a host. Alerts when changes are made to files in /boot, indicating installation of a new kernel or boot configuration.
  • instanceId
Log Files Deleted Log deletion not performed by a log management tool could indicate that an attacker is trying to remove indicators of compromise. Alerts on deletion of system log files.
  • instanceId
New File Executed Newly created files from sources other than system update programs might be backdoors, kernel exploits, or part of an exploitation chain. Alerts when a file that has been created or modified within 30 minutes is then executed, excluding files created by system update programs.
  • instanceId
Root Certificate Store Modified Modification of the root certificate store could indicate the installation of a rogue certificate authority, enabling interception of network traffic or bypass of code signature verification. Alerts when a system CA certificate store is changed.
  • instanceId
Setuid/Setgid Bit Set On File Setting setuid/setgid bits can be used to provide a persistent method for privilege escalation on a node. Alerts when the setuid or setgid bit is set on a file with the chmod family of system calls.
  • instanceId
Hidden File Created Attackers often create hidden files as a means of obscuring tools and payloads on a compromised host. Alerts when a hidden file is created by a process associated with an ongoing incident.
  • instanceId
Modification Of Common System Utilities Attackers might modify system utilities in order to execute malicious payloads whenever these utilities are run. Alerts when a common system utility is modified by an unauthorized process.
  • instanceId
Network Service Scanner Executed An attacker or rogue user might use or install these programs to survey connected networks for additional nodes to compromise. Alerts when common network scanning program tools are executed.
  • instanceId
Network Service Created Attackers might start a new network service to provide easy access to a host after compromise. Alerts when a program starts a new network service, if the program is already part of an ongoing incident.
  • instanceId
Network Sniffing Program Executed An attacker or rogue user might execute network sniffing commands to capture credentials, personally-identifiable information (PII), or other sensitive information. Alerts when a program is executed that allows network capture.
  • instanceId
Remote File Copy Detected Use of file transfer tools could indicate that an attacker is attempting to move toolsets to additional hosts or exfiltrate data to a remote system. Alerts when a program associated with remote file copying is executed, if the program is already part of an ongoing incident.
  • instanceId
Unusual Outbound Connection Detected Command and Control channels and cryptocoin miners often create new outbound network connections on unusual ports. Alerts when a program initiates a new connection on an uncommon port, if the program is already part of an ongoing incident.
  • instanceId
Data Archived Via Program After gaining access to a system, an attacker might create a compressed archive of files to reduce the size of data for exfiltration. Alerts when a data compression program is executed, if the program is already part of an ongoing incident.
  • instanceId
Process Injection Use of process injection techniques commonly indicates that a user is debugging a program, but might also indicate that an attacker is reading secrets from or injecting code into other processes. Alerts when a program uses ptrace (debugging) mechanisms to interact with another process.
  • instanceId
Account Enumeration Via Program Attackers often use account enumeration programs to determine their level of access and to see if other users are currently logged in to the node. Alerts when a program associated with account enumeration is executed, if the program is already part of an ongoing incident.
  • instanceId
File and Directory Discovery Via Program Exploring file systems is common post-exploitation behavior for an attacker looking for credentials and data of interest. Alerts when a program associated with file and directory enumeration is executed, if the program is already part of an ongoing incident.
  • instanceId
Network Configuration Enumeration Via Program Attackers can interrogate local network and route information to identify adjacent hosts and networks ahead of lateral movement. Alerts when a program associated with network configuration enumeration is executed, if the program is already part of an ongoing incident.
  • instanceId
Process Enumeration Via Program Attackers often list running programs in order to identify the purpose of a node and whether any security or monitoring tools are in place. Alerts when a program associated with process enumeration is executed, if the program is already part of an ongoing incident.
  • instanceId
System Information Enumeration Via Program Attackers commonly execute system enumeration commands to determine Linux kernel and distribution versions and features, often to identify if the node is affected by specific vulnerabilities. Alerts when a program associated with system information enumeration is executed, if the program is already part of an ongoing incident.
  • instanceId
Scheduled Tasks Modified Via Program Modifying scheduled tasks is a common method for establishing persistence on a compromised node. Alerts when the crontab, at, or batch commands are used to modify scheduled task configurations.
  • instanceId
Systemctl Usage Detected Changes to systemd units could result in security controls being relaxed or disabled, or the installation of a malicious service. Alerts when the systemctl command is used to modify systemd units.
  • instanceId
User Execution Of su Command Explicit escalation to the root user decreases the ability to correlate privileged activity to a specific user. Alerts when the su command is executed.
  • instanceId
User Execution Of sudo Command Alerts when the sudo command is executed.
  • instanceId
User Command History Cleared Deleting the history file is unusual, commonly performed by attackers hiding activity, or by legitimate users intending to evade audit controls. Alerts when command line history files are deleted.
  • instanceId
New System User Added An attacker might add a new user to a host to provide a reliable method of access. Alerts if a new user entity is added to the local account management file /etc/passwd, if the entity is not added by a system update program.
  • instanceId
Password Database Modification Attackers might directly modify identity-related files to add a new user to the system. Alerts when a file related to user passwords is modified by a program unrelated to updating existing user information.
  • instanceId
SSH Authorized Keys Modification Adding a new SSH public key is a common method for gaining persistent access to a compromised host. Alerts when an attempt to write to a user's SSH authorized_keys file is observed, if the program is already part of an ongoing incident.
  • instanceId
User Account Created Via CLI Adding a new user is a common step for attackers when establishing persistence on a compromised node. Alerts when an identity management program is executed by a program other than a package manager.
  • instanceId
User Configuration Changes Deleting the history file is unusual, commonly performed by attackers hiding activity, or by legitimate users intending to evade audit controls. Alerts when command line history files are deleted.
  • instanceId
New System User Added User profile and configuration files are often modified as a method of persistence in order to execute a program whenever a user logs in. Alerts when .bash_profile and bashrc (as well as related files) are modified by a program other than a system update tool.
  • instanceId

Antivirus monitoring events

Note

The response JSON object in these audit logs always has a result field that includes one line of the original scan result. Each scan result is represented typically by multiple audit log records, one for each line of the original scan output. For details of what could appear in this file, see the following third-party documentation.

The following event is logged at the workspace level.

These events are logged under the service_name of clamAVScanService-dataplane.

action_name Description request_params
clamAVScanAction The antivirus monitoring performs a scan. A log will generate for each line of the original scan output.
  • instanceId

SQL table access events

Note

The sqlPermissions service includes events related to the legacy Hive metastore table access control. Databricks recommends that you upgrade the tables managed by the Hive metastore to the Unity Catalog metastore.

These events are logged at the workspace level.

These events are logged under the service_name of sqlPermissions.

action_name Description request_params
changeSecurableOwner Workspace admin or owner of an object transfers object ownership.
  • securable
  • principal
createSecurable User creates a securable object.
  • securable
denyPermission Object owner denies privileges on a securable object.
  • permission
grantPermission Object owner grants permission on a securable object.
  • permission
removeAllPermissions User drops a securable object.
  • securable
renameSecurable User renames a securable object.
  • before
  • after
requestPermissions User requests permissions on a securable object.
  • requests
  • denied
  • permitted
revokePermission Object owner revokes permissions on their securable object.
  • permission
showPermissions User views securable object permissions.
  • securable
  • principal

Deprecated log events

Databricks has deprecated the following serverlessRealTimeInference diagnostic events. These events were associated with Legacy MLflow Model Serving, which reached end of life on September 15, 2025.

  • enable
  • disable

Databricks has deprecated the following databrickssql diagnostic events:

  • createAlertDestination (now createNotificationDestination)
  • deleteAlertDestination (now deleteNotificationDestination)
  • updateAlertDestination (now updateNotificationDestination)
  • muteAlert
  • unmuteAlert

SQL endpoint logs

If you create SQL warehouses using the deprecated SQL endpoint API (the former name for SQL warehouses), the corresponding audit event name will include the word Endpoint instead of Warehouse. Besides the name, these events are identical to the SQL warehouse events. To view descriptions and request parameters of these events, see their corresponding warehouse events in Databricks SQL events.

The SQL endpoint events are:

  • changeEndpointAcls
  • createEndpoint
  • editEndpoint
  • startEndpoint
  • stopEndpoint
  • deleteEndpoint
  • setEndpointConfig
  • Last updated on