Skip to content

Manage Access Audits

Runtime tab

The Runtime tab describes the Omni Connector on a Runtime Plane, which is a separate connector from PolicySync. Sections without a Runtime tab apply to PolicySync only.

The Databricks SQL connector provides access auditing capabilities to help organizations track user activity, ensure compliance, and enhance security monitoring.

Audit Configuration

  • Audit Enable: Enables audit logs for the Databricks SQL. Set this property to true to enable audit logging.
  • Audit Excluded Users: Comma-separated list of users to exclude from audits (e.g.,user1@gmail.com).
  • Audit Initial Pull Minutes: Specifies the number of minutes of audit data to retrieve during the initial sync when auditing is first enabled. The default is 30 minutes.

Setup

Warning

  • Replace the example values with your actual values.

  1. SSH to the instance where Privacera Manager is installed.

  2. Run the following command to open the .yml file to be edited.

    If you have multiple connectors, then replace instance1 with the appropriate connector instance name.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/databricks-sql-analytics/instance1/vars.connector.databricks.sql.analytics.yml

  3. Add or update the following properties to enable access audits:

    YAML
    1
2
3
    CONNECTOR_DATABRICKS_SQL_ANALYTICS_AUDIT_ENABLE: "true"
CONNECTOR_DATABRICKS_SQL_ANALYTICS_AUDIT_EXCLUDED_USERS: "user1@gmail.com"
CONNECTOR_DATABRICKS_SQL_ANALYTICS_AUDIT_INITIAL_PULL_MINUTES: "40"

  4. Once the properties are configured, run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  1. In PrivaceraCloud portal, navigate to Settings → Applications.

  2. On the Connected Applications screen, select Databricks SQL.

  3. Click on the icon or the Account Name to modify the settings.

  4. On the Edit Application screen, go to Access Management.

  5. Under BASIC tab, enable Enable access audits with the toggle.

  6. Under ADVANCED tab, enter the following values:

    • Users to exclude when fetching access audits: user1@gmail.com

  7. Enter the following properties under Add New Custom Properties:

    Bash
    1
    ranger.policysync.connector.0.audit.init.starttime.offset.minutes=40

  8. Click SAVE to apply the changes.

Access audits for the Omni Connector are fetched from the workspace's SQL query history and delivered to the Audit Server. They are off by default.

Warning

  • The connector's principal must be a workspace admin to see other users' queries.
  • Audit records carry the SQL statement text as it is, unless the workspace redacts it. Set Request data cap (bytes) to 0 to send no statement text.

  1. In the portal, navigate to Settings → Runtime Plane and open your Runtime Plane.

  2. Open the Connectors tab and open your Databricks SQL (Hive Metastore) connector.

  3. Go to ACCESS CONTROL CONFIGS and expand Manage Access Audits.

  4. Turn on Enable access audits, and review the other settings:

    • Audit fetch schedule: six-field cron in UTC. Default 0 0 */4 * * *.
    • Delay window (seconds): default 3600.
    • Backfill window: ISO-8601 duration for the first run. Default PT4H.
    • Users to exclude: principals whose audits are dropped, matched against the query history user_name. A service principal appears as its application ID, and a user as their email.

  5. Select Save.

For all fields, see Access audits.