POST_START

Investigating a Specific User During a Production Access Incident

I was called in to investigate a potential access incident involving a user with the email address engineer@example.com. The incident report mentioned that a user might have accessed production data, and I needed to trace their activity using Databricks Unity Catalog’s audit logs. I started by querying the system.access.audit table to find all events related to this user.

SELECT event_time, user_identity, action_name, request_params FROM system.access.audit WHERE user_identity.email = 'engineer@example.com' ORDER BY event_time DESC;

The first result showed that the user engineer@demo.com had accessed the production.sales.customers table at 14:31:55. I noticed that the user had performed a getTable action, which is typically used to retrieve data from a table. I wanted to dig deeper to see if there were any other actions related to production data.

SELECT event_time, action_name, request_params FROM system.access.audit WHERE user_identity.email = 'engineer@example.com' AND request_params LIKE '%production%' ORDER BY event_time DESC;

The second query filtered the results to only include events where the request parameters contained the word “production.” This confirmed that the user had accessed a production table, and the timestamp matched the previous result. This helped solidify the timeline of events and showed that the user had indeed accessed production data.

I verified that the user engineer@demo.com was the one responsible for the access and that their actions were directly related to the production environment. I documented the findings and prepared a report to be shared with the security team for further review.