Databricks publishes guidance on detecting and responding to credential-driven attacks
Overview
Databricks publishes a blog post explaining how an attacker who obtains a stolen session cookie, personal access token, or service-principal credential can operate on its platform.
The post describes using verbose audit logs and Genie to spot shifts in an identity's behavior, steps to take after a compromise is confirmed, and controls that limit what a stolen credential can do.
The post is first-party material from Databricks, and this overview reflects only its described contents.
Written by AI from the articles below · updated Nov 11, 6:28 PM ET
Check the sources:
Article timeline
The articles in this story. Times are ET.
- Databricks BlogOfficialDatabricks explains how to detect credential-driven attacks on its platform
AIDatabricks explains how a credential-driven attack unfolds on its platform, after an attacker gains access with a stolen session cookie, personal access token, or service-principal credential. The post describes using verbose audit logs and Genie to detect shifts in an identity's behavior, how to respond after confirming a compromise, and which controls limit what a stolen credential can do.
Heat Trend
- Current comparable heat
- 7
- Peak comparable heat
- 10Nov 11, 7:00 PM ET
- Change in past 24 hours
- –
The trend compares only continuously observed participants, so its scope may be smaller than the current heat total. Hover or tap for hourly heat; use arrow keys with a keyboard.