{"resources":{"databricks":{"id":"databricks","name":"databricks","fields":{"catalog":{"name":"catalog","type":"\u001bdatabricks.catalog","title":"Unity Catalog catalog","desc":"A Unity Catalog catalog accessible from the workspace, keyed by name. Covers the owner, the metastore it belongs to, the isolation mode that controls which workspaces can bind it, the schemas it contains, and the privilege grants assigned on it. Select a catalog by name, for example `databricks.catalogs.where(name == \"main\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"catalogs":{"name":"catalogs","type":"\u0019\u001bdatabricks.catalog","title":"Unity Catalog catalogs accessible from the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"cluster":{"name":"cluster","type":"\u001bdatabricks.cluster","title":"Databricks compute cluster","desc":"A compute cluster in the workspace, keyed by its cluster id. Covers the data security mode that governs Unity Catalog isolation, the Spark runtime and configuration, local disk encryption, the auto-termination window, and the policy the cluster was created against. Select a cluster by id, for example `databricks.clusters.where(clusterName == \"shared\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"clusterPolicies":{"name":"clusterPolicies","type":"\u0019\u001bdatabricks.clusterPolicy","title":"Cluster policies configured in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"clusterPolicy":{"name":"clusterPolicy","type":"\u001bdatabricks.clusterPolicy","title":"Databricks cluster policy","desc":"A cluster policy in the workspace that constrains the attributes of clusters created against it, keyed by name. Covers the JSON policy document, the per-user cluster cap, and whether the policy is the workspace default. Select a policy by name, for example `databricks.clusterPolicies.where(name == \"job-only\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"clusters":{"name":"clusters","type":"\u0019\u001bdatabricks.cluster","title":"Compute clusters in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"customerManagedKey":{"name":"customerManagedKey","type":"\u001bdatabricks.customerManagedKey","title":"Customer-managed encryption key","desc":"An encryption key registered in the account for protecting workspace managed services or storage, keyed by its configuration id. Covers the use cases the key applies to (MANAGED_SERVICES for control-plane notebooks, secrets, and query history, STORAGE for the workspace root bucket and, optionally, cluster EBS volumes), the creation time, and the cloud key identifiers (the AWS KMS key ARN, alias, and region, or the GCP KMS key resource id). Select a key by id, for example `databricks.customerManagedKeys.where(id == \"...\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"customerManagedKeys":{"name":"customerManagedKeys","type":"\u0019\u001bdatabricks.customerManagedKey","title":"Customer-managed encryption keys registered in the account","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"deltaSharingRecipient":{"name":"deltaSharingRecipient","type":"\u001bdatabricks.deltaSharingRecipient","title":"Delta Sharing recipient","desc":"A recipient that workspace data is shared with through Delta Sharing, keyed by name. Covers the authentication type (TOKEN for open sharing secured by a bearer token, DATABRICKS for Databricks-to-Databricks sharing between metastores), whether the recipient has been activated, the owner and comment, the data recipient's global metastore id for Databricks-to-Databricks sharing, the IP access list restricting where the recipient may connect from, and non-secret metadata for each issued token. Token secret values and activation URLs are never exposed. Select a recipient by name, for example `databricks.deltaSharingRecipients.where(name == \"partner\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"deltaSharingRecipients":{"name":"deltaSharingRecipients","type":"\u0019\u001bdatabricks.deltaSharingRecipient","title":"Delta Sharing recipients configured in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"deltaSharingShare":{"name":"deltaSharingShare","type":"\u001bdatabricks.deltaSharingShare","title":"Delta Sharing share","desc":"A share, a named collection of data objects made available to Delta Sharing recipients, keyed by name. Covers the owner, comment, the data objects included in the share, and creation and modification metadata. Select a share by name, for example `databricks.deltaSharingShares.where(name == \"sales\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"deltaSharingShares":{"name":"deltaSharingShares","type":"\u0019\u001bdatabricks.deltaSharingShare","title":"Delta Sharing shares configured in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"externalLocation":{"name":"externalLocation","type":"\u001bdatabricks.externalLocation","title":"Unity Catalog external location","desc":"An external location maps a cloud storage path to a storage credential and bounds the reach of Unity Catalog access to that path. Auditing external locations surfaces the storage URL, the credential used to reach it, the isolation mode that controls which workspaces can bind it, whether it is read-only, whether fallback to cluster credentials is allowed, the server-side encryption applied to the path, and the privilege grants assigned on it. Select a location by name, for example `databricks.externalLocations.where(name == \"prod-landing\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"externalLocations":{"name":"externalLocations","type":"\u0019\u001bdatabricks.externalLocation","title":"Unity Catalog external locations in the workspace's metastore","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"globalInitScript":{"name":"globalInitScript","type":"\u001bdatabricks.globalInitScript","title":"Global init script","desc":"A script that runs on every cluster in the workspace during startup, keyed by its script id. Because it executes on all clusters, an enabled global init script is a persistence and code-execution vector worth auditing. Covers the name, whether it is enabled, its run-order position, and creation and modification metadata. Select a script by id, for example `databricks.globalInitScripts.where(name == \"bootstrap\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"globalInitScripts":{"name":"globalInitScripts","type":"\u0019\u001bdatabricks.globalInitScript","title":"Global init scripts that run on every cluster in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"grant":{"name":"grant","type":"\u001bdatabricks.grant","title":"Unity Catalog privilege grant","desc":"A set of privileges granted to a single principal on a Unity Catalog securable (a catalog or schema). Covers the principal, the granted privileges (such as SELECT, MODIFY, ALL_PRIVILEGES, or USE_SCHEMA), and the securable the grant applies to.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"group":{"name":"group","type":"\u001bdatabricks.group","title":"Databricks account group","desc":"A group provisioned in the Databricks account through SCIM, keyed by displayName. Covers the members (users, service principals, and nested groups), the account-level entitlements granted to the group, and cloud roles. Select a group by name, for example `databricks.groups.where(displayName == \"admins\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"groups":{"name":"groups","type":"\u0019\u001bdatabricks.group","title":"Account groups provisioned through SCIM","provider":"go.mondoo.com/mql/providers/databricks"},"instanceProfile":{"name":"instanceProfile","type":"\u001bdatabricks.instanceProfile","title":"AWS instance profile","desc":"An AWS instance profile registered in the workspace that clusters can assume to obtain AWS credentials, keyed by its ARN. This is the legacy instance-profile credential path. A meta instance profile can assume a wide range of roles and warrants closer review. Covers the instance profile ARN, the associated IAM role ARN, and whether it is a meta instance profile. Select a profile by ARN, for example `databricks.instanceProfiles.where(isMetaInstanceProfile == true)`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"instanceProfiles":{"name":"instanceProfiles","type":"\u0019\u001bdatabricks.instanceProfile","title":"AWS instance profiles registered in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"ipAccessList":{"name":"ipAccessList","type":"\u001bdatabricks.ipAccessList","title":"Databricks workspace IP access list","desc":"A list of IP ranges allowed or blocked from reaching a workspace, keyed by label. Covers the list type, the CIDR ranges it contains, and whether it is enabled. Select a list by label, for example `databricks.ipAccessLists.where(label == \"office\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"ipAccessLists":{"name":"ipAccessLists","type":"\u0019\u001bdatabricks.ipAccessList","title":"IP access lists configured on the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"metastore":{"name":"metastore","type":"\u001bdatabricks.metastore","title":"Unity Catalog metastore","desc":"A Unity Catalog metastore registered in the account, keyed by name. Covers the owner, hosting cloud and region, storage root, the Delta Sharing scope and recipient token lifetime, and whether external access is enabled. Select a metastore by name, for example `databricks.metastores.where(name == \"primary\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"metastores":{"name":"metastores","type":"\u0019\u001bdatabricks.metastore","title":"Unity Catalog metastores in the account","provider":"go.mondoo.com/mql/providers/databricks"},"modelVersion":{"name":"modelVersion","type":"\u001bdatabricks.modelVersion","title":"Unity Catalog model version","desc":"A single version of a Unity Catalog registered model, keyed by the parent model's fully qualified name and the version number. Covers the registration status, the source artifact location, the MLflow run that produced it, the storage location backing its files, and the aliases pointing at it.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"network":{"name":"network","type":"\u001bdatabricks.network","title":"Databricks account network","desc":"A customer-managed network registered in the account for workspace deployment, keyed by networkName. Covers the cloud network identifiers (VPC, subnets, security groups) and their validation status. Select a network by name, for example `databricks.networks.where(networkName == \"prod-vpc\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"networks":{"name":"networks","type":"\u0019\u001bdatabricks.network","title":"Customer-managed networks registered in the account","provider":"go.mondoo.com/mql/providers/databricks"},"privateAccessSetting":{"name":"privateAccessSetting","type":"\u001bdatabricks.privateAccessSetting","title":"Databricks private access settings","desc":"Private connectivity settings that govern how a workspace is reached over the cloud provider's private network, keyed by name. Covers whether public access is allowed alongside private access, the private access level, and the VPC endpoints permitted to reach the workspace. Select a setting by name, for example `databricks.privateAccessSettings.where(name == \"prod-pas\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"privateAccessSettings":{"name":"privateAccessSettings","type":"\u0019\u001bdatabricks.privateAccessSetting","title":"Private access settings registered in the account","provider":"go.mondoo.com/mql/providers/databricks"},"registeredModel":{"name":"registeredModel","type":"\u001bdatabricks.registeredModel","title":"Unity Catalog registered model","desc":"A registered model in Unity Catalog, keyed by its three-level fully qualified name (catalog.schema.model). Covers the owner, comment, storage location backing the model version files, the parent catalog and schema, the aliases pointing at model versions, the privilege grants assigned on it, and the model versions it contains. Select a model by full name, for example `databricks.registeredModels.where(name == \"fraud_detector\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"registeredModels":{"name":"registeredModels","type":"\u0019\u001bdatabricks.registeredModel","title":"Unity Catalog registered models in the workspace's metastore","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"schema":{"name":"schema","type":"\u001bdatabricks.schema","title":"Unity Catalog schema","desc":"A schema within a Unity Catalog catalog, keyed by its fully qualified name (catalog.schema). Covers the owner, the parent catalog, and the privilege grants assigned on it. Select a schema by full name, for example `databricks.catalogs.where(name == \"main\").schemas.where(name == \"sales\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"secretScope":{"name":"secretScope","type":"\u001bdatabricks.secretScope","title":"Databricks secret scope","desc":"A secret scope in the workspace, keyed by name. Covers the backend storing the secrets (a Databricks-managed store or an Azure Key Vault) and the access-control list mapping each principal to its permission on the scope. Select a scope by name, for example `databricks.secretScopes.where(name == \"prod\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"secretScopes":{"name":"secretScopes","type":"\u0019\u001bdatabricks.secretScope","title":"Secret scopes configured in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"servicePrincipal":{"name":"servicePrincipal","type":"\u001bdatabricks.servicePrincipal","title":"Databricks account service principal","desc":"A machine identity provisioned in the Databricks account through SCIM, keyed by applicationId (the OAuth client id). Covers the active state, account-level entitlements, cloud roles, and group memberships. Select a service principal by application id, for example `databricks.servicePrincipals.where(applicationId == \"...\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"servicePrincipals":{"name":"servicePrincipals","type":"\u0019\u001bdatabricks.servicePrincipal","title":"Account service principals provisioned through SCIM","provider":"go.mondoo.com/mql/providers/databricks"},"servingEndpoint":{"name":"servingEndpoint","type":"\u001bdatabricks.servingEndpoint","title":"Mosaic AI model serving endpoint","desc":"A Mosaic AI model serving endpoint in the workspace, keyed by name. Covers the endpoint state and pending configuration update, the creator, the task type, the budget policy, and the creation and update times. The served entities behind the endpoint are exposed through servedEntities, and the AI Gateway governance (usage tracking, inference-table payload logging, guardrails, and rate limits) through aiGateway. Select an endpoint by name, for example `databricks.servingEndpoints.where(name == \"prod-llm\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"servingEndpoints":{"name":"servingEndpoints","type":"\u0019\u001bdatabricks.servingEndpoint","title":"Mosaic AI model serving endpoints in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"storageCredential":{"name":"storageCredential","type":"\u001bdatabricks.storageCredential","title":"Unity Catalog storage credential","desc":"A storage credential holds the cloud identity Unity Catalog assumes to reach external storage: an AWS IAM role, an Azure managed identity or service principal, or a GCP service account. Auditing storage credentials surfaces the vended principal (the AWS role ARN and its external ID, the Azure access connector, the Azure application ID, or the GCP service account email), the isolation mode that controls which workspaces can use it, whether it is read-only or backs the metastore's root managed storage, and the privilege grants assigned on it. Select a credential by name, for example `databricks.storageCredentials.where(name == \"prod-s3\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"storageCredentials":{"name":"storageCredentials","type":"\u0019\u001bdatabricks.storageCredential","title":"Unity Catalog storage credentials in the workspace's metastore","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"token":{"name":"token","type":"\u001bdatabricks.token","title":"Databricks personal access token","desc":"A personal access token issued in the workspace, keyed by its token id. Covers the owning user, the creation and expiry times, and the comment set on the token. A token with no expiry never expires and is a standing credential. Select a token by id, for example `databricks.tokens.where(comment == \"ci\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"tokens":{"name":"tokens","type":"\u0019\u001bdatabricks.token","title":"Personal access tokens issued in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"user":{"name":"user","type":"\u001bdatabricks.user","title":"Databricks account user","desc":"A user account provisioned in the Databricks account through SCIM, keyed by userName (the login email). Covers the active state, account-level entitlements (such as allow-cluster-create or databricks-sql-access), the cloud roles granted to the user, and group memberships. Select a user by name, for example `databricks.users.where(userName == \"alice@example.com\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bdatabricks.user","title":"Account users provisioned through SCIM","provider":"go.mondoo.com/mql/providers/databricks"},"volume":{"name":"volume","type":"\u001bdatabricks.volume","title":"Unity Catalog volume","desc":"A Unity Catalog volume governs access to a directory of non-tabular data under a schema, keyed by its fully qualified name. Auditing volumes surfaces the volume type (EXTERNAL volumes live in a cloud storage path outside managed storage, MANAGED volumes live in the schema's default location), the storage location backing an external volume, the server-side encryption applied to it, the owner, and the privilege grants assigned on it. For example `databricks.catalogs.schemas.volumes.where(volumeType == \"EXTERNAL\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"warehouse":{"name":"warehouse","type":"\u001bdatabricks.warehouse","title":"Databricks SQL warehouse","desc":"A SQL warehouse in the workspace, keyed by name. Covers the warehouse type, whether Photon and serverless compute are enabled, the release channel, and the current state. Select a warehouse by name, for example `databricks.warehouses.where(name == \"bi\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"warehouses":{"name":"warehouses","type":"\u0019\u001bdatabricks.warehouse","title":"SQL warehouses in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"workspace":{"name":"workspace","type":"\u001bdatabricks.workspace","title":"Databricks workspace","desc":"A workspace registered in the Databricks account, keyed by the numeric workspaceId. Covers the deployment name, provisioning status, pricing tier, hosting cloud and region, the customer-managed keys protecting managed services and storage, and the network and private access settings that isolate the workspace. Select a workspace by id, for example `databricks.workspaces.where(workspaceId == 123456789)`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"workspaceConf":{"name":"workspaceConf","type":"\u001bdatabricks.workspaceConf","title":"Databricks workspace security settings","desc":"Security-relevant workspace configuration read from the workspace conf, such as whether personal access tokens are permitted, the maximum token lifetime, whether IP access lists are enforced, and whether legacy global init scripts are enabled. A field is null when the corresponding conf key is unset.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"workspaceSettings":{"name":"workspaceSettings","type":"\u001bdatabricks.workspaceConf","title":"Security-relevant configuration of the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"workspaces":{"name":"workspaces","type":"\u0019\u001bdatabricks.workspace","title":"Workspaces registered in the account","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks","desc":"Entry point to a Databricks account and its workspaces. Connecting to the account console exposes account-level identity and networking through the users, groups, servicePrincipals, metastores, networks, privateAccessSettings, and customerManagedKeys fields, and enumerates every workspace through the workspaces field. Connecting to a single workspace exposes that workspace's security surface through the ipAccessLists, workspaceSettings, tokens, secretScopes, clusters, clusterPolicies, warehouses, catalogs, storageCredentials, externalLocations, deltaSharingRecipients, deltaSharingShares, globalInitScripts, instanceProfiles, servingEndpoints, and registeredModels fields.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.catalog":{"id":"databricks.catalog","name":"databricks.catalog","fields":{"catalogType":{"name":"catalogType","type":"\u0007","is_mandatory":true,"title":"Catalog type","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Catalog comment","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the catalog","provider":"go.mondoo.com/mql/providers/databricks"},"isolationMode":{"name":"isolationMode","type":"\u0007","is_mandatory":true,"title":"Isolation mode (ISOLATED or OPEN)","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the catalog belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Catalog name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the catalog","provider":"go.mondoo.com/mql/providers/databricks"},"schemas":{"name":"schemas","type":"\u0019\u001bdatabricks.schema","title":"Schemas contained in the catalog","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog catalog","desc":"A Unity Catalog catalog accessible from the workspace, keyed by name. Covers the owner, the metastore it belongs to, the isolation mode that controls which workspaces can bind it, the schemas it contains, and the privilege grants assigned on it. Select a catalog by name, for example `databricks.catalogs.where(name == \"main\")`.","min_provider_version":"13.0.0","defaults":"name owner isolationMode","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.cluster":{"id":"databricks.cluster","name":"databricks.cluster","fields":{"autoterminationMinutes":{"name":"autoterminationMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes of inactivity before the cluster auto-terminates, 0 when disabled","provider":"go.mondoo.com/mql/providers/databricks"},"clusterName":{"name":"clusterName","type":"\u0007","is_mandatory":true,"title":"Cluster name","provider":"go.mondoo.com/mql/providers/databricks"},"creatorUserName":{"name":"creatorUserName","type":"\u0007","is_mandatory":true,"title":"Login name of the user that created the cluster","provider":"go.mondoo.com/mql/providers/databricks"},"customTags":{"name":"customTags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom tags applied to the cluster","provider":"go.mondoo.com/mql/providers/databricks"},"dataSecurityMode":{"name":"dataSecurityMode","type":"\u0007","is_mandatory":true,"title":"Data security mode","desc":"Governs Unity Catalog isolation. Values include SINGLE_USER, USER_ISOLATION, DATA_SECURITY_MODE_DEDICATED, DATA_SECURITY_MODE_STANDARD, DATA_SECURITY_MODE_AUTO, NONE, and the LEGACY_* modes (LEGACY_PASSTHROUGH, LEGACY_SINGLE_USER, LEGACY_SINGLE_USER_STANDARD, LEGACY_TABLE_ACL).","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cluster id","provider":"go.mondoo.com/mql/providers/databricks"},"localDiskEncryptionEnabled":{"name":"localDiskEncryptionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether local disk encryption is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"policy":{"name":"policy","type":"\u001bdatabricks.clusterPolicy","title":"Policy the cluster was created against","provider":"go.mondoo.com/mql/providers/databricks"},"runtimeEngine":{"name":"runtimeEngine","type":"\u0007","is_mandatory":true,"title":"Runtime engine (NULL, PHOTON, or STANDARD)","provider":"go.mondoo.com/mql/providers/databricks"},"singleUserName":{"name":"singleUserName","type":"\u0007","is_mandatory":true,"title":"User a single-user cluster runs as","provider":"go.mondoo.com/mql/providers/databricks"},"sparkConf":{"name":"sparkConf","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Spark configuration key/value pairs","provider":"go.mondoo.com/mql/providers/databricks"},"sparkEnvVars":{"name":"sparkEnvVars","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Spark environment variables","provider":"go.mondoo.com/mql/providers/databricks"},"sparkVersion":{"name":"sparkVersion","type":"\u0007","is_mandatory":true,"title":"Databricks Runtime version","provider":"go.mondoo.com/mql/providers/databricks"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current state (such as RUNNING or TERMINATED)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks compute cluster","desc":"A compute cluster in the workspace, keyed by its cluster id. Covers the data security mode that governs Unity Catalog isolation, the Spark runtime and configuration, local disk encryption, the auto-termination window, and the policy the cluster was created against. Select a cluster by id, for example `databricks.clusters.where(clusterName == \"shared\")`.","min_provider_version":"13.0.0","defaults":"clusterName dataSecurityMode state","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.clusterPolicy":{"id":"databricks.clusterPolicy","name":"databricks.clusterPolicy","fields":{"creatorUserName":{"name":"creatorUserName","type":"\u0007","is_mandatory":true,"title":"Login name of the user that created the policy","provider":"go.mondoo.com/mql/providers/databricks"},"definition":{"name":"definition","type":"\u0007","is_mandatory":true,"title":"JSON document defining the policy rules","provider":"go.mondoo.com/mql/providers/databricks"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy id","provider":"go.mondoo.com/mql/providers/databricks"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether the policy is the workspace default","provider":"go.mondoo.com/mql/providers/databricks"},"maxClustersPerUser":{"name":"maxClustersPerUser","type":"\u0005","is_mandatory":true,"title":"Maximum number of clusters a single user may create with the policy","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks cluster policy","desc":"A cluster policy in the workspace that constrains the attributes of clusters created against it, keyed by name. Covers the JSON policy document, the per-user cluster cap, and whether the policy is the workspace default. Select a policy by name, for example `databricks.clusterPolicies.where(name == \"job-only\")`.","min_provider_version":"13.0.0","defaults":"name maxClustersPerUser","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.customerManagedKey":{"id":"databricks.customerManagedKey","name":"databricks.customerManagedKey","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the key configuration was created","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Encryption key configuration id","provider":"go.mondoo.com/mql/providers/databricks"},"keyAlias":{"name":"keyAlias","type":"\u0007","is_mandatory":true,"title":"Alias of the AWS KMS key, empty for non-AWS keys","provider":"go.mondoo.com/mql/providers/databricks"},"keyArn":{"name":"keyArn","type":"\u0007","is_mandatory":true,"title":"ARN of the AWS KMS key, empty for non-AWS keys","provider":"go.mondoo.com/mql/providers/databricks"},"keyRegion":{"name":"keyRegion","type":"\u0007","is_mandatory":true,"title":"Region of the AWS KMS key, empty for non-AWS keys","provider":"go.mondoo.com/mql/providers/databricks"},"kmsKeyId":{"name":"kmsKeyId","type":"\u0007","is_mandatory":true,"title":"Resource id of the GCP KMS key, empty for non-GCP keys","provider":"go.mondoo.com/mql/providers/databricks"},"useCases":{"name":"useCases","type":"\u0019\u0007","is_mandatory":true,"title":"Use cases the key applies to","desc":"Each entry is MANAGED_SERVICES (control-plane notebooks, secrets, and query history) or STORAGE (the workspace root bucket and, optionally, cluster EBS volumes).","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Customer-managed encryption key","desc":"An encryption key registered in the account for protecting workspace managed services or storage, keyed by its configuration id. Covers the use cases the key applies to (MANAGED_SERVICES for control-plane notebooks, secrets, and query history, STORAGE for the workspace root bucket and, optionally, cluster EBS volumes), the creation time, and the cloud key identifiers (the AWS KMS key ARN, alias, and region, or the GCP KMS key resource id). Select a key by id, for example `databricks.customerManagedKeys.where(id == \"...\")`.","min_provider_version":"13.0.1","defaults":"id useCases creationTime","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.deltaSharingRecipient":{"id":"databricks.deltaSharingRecipient","name":"databricks.deltaSharingRecipient","fields":{"activated":{"name":"activated","type":"\u0004","is_mandatory":true,"title":"Whether the recipient's activation URL has been exercised","provider":"go.mondoo.com/mql/providers/databricks"},"authenticationType":{"name":"authenticationType","type":"\u0007","is_mandatory":true,"title":"Authentication type","desc":"One of TOKEN (open sharing secured by a bearer token), DATABRICKS (Databricks-to-Databricks sharing between metastores), OAUTH_CLIENT_CREDENTIALS, or OIDC_FEDERATION.","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Recipient comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the recipient was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the recipient","provider":"go.mondoo.com/mql/providers/databricks"},"dataRecipientGlobalMetastoreId":{"name":"dataRecipientGlobalMetastoreId","type":"\u0007","is_mandatory":true,"title":"Global metastore id of the data recipient, present for DATABRICKS authentication","provider":"go.mondoo.com/mql/providers/databricks"},"ipAccessList":{"name":"ipAccessList","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed IP addresses in CIDR notation the recipient may connect from","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Recipient name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the recipient","provider":"go.mondoo.com/mql/providers/databricks"},"tokens":{"name":"tokens","type":"\u0019\n","is_mandatory":true,"title":"Non-secret metadata for each issued token","desc":"One entry per token with its id, expirationTime, and createdAt. Token secret values and activation URLs are deliberately excluded.","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the recipient was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the recipient","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Delta Sharing recipient","desc":"A recipient that workspace data is shared with through Delta Sharing, keyed by name. Covers the authentication type (TOKEN for open sharing secured by a bearer token, DATABRICKS for Databricks-to-Databricks sharing between metastores), whether the recipient has been activated, the owner and comment, the data recipient's global metastore id for Databricks-to-Databricks sharing, the IP access list restricting where the recipient may connect from, and non-secret metadata for each issued token. Token secret values and activation URLs are never exposed. Select a recipient by name, for example `databricks.deltaSharingRecipients.where(name == \"partner\")`.","min_provider_version":"13.0.1","defaults":"name authenticationType activated","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.deltaSharingShare":{"id":"databricks.deltaSharingShare","name":"databricks.deltaSharingShare","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Share comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the share was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the share","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Share name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the share","provider":"go.mondoo.com/mql/providers/databricks"},"sharedObjects":{"name":"sharedObjects","type":"\u0019\n","is_mandatory":true,"title":"Data objects included in the share","desc":"One entry per shared object with its name, dataObjectType, sharedAs, cdfEnabled, comment, addedAt, and addedBy.","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the share was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the share","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Delta Sharing share","desc":"A share, a named collection of data objects made available to Delta Sharing recipients, keyed by name. Covers the owner, comment, the data objects included in the share, and creation and modification metadata. Select a share by name, for example `databricks.deltaSharingShares.where(name == \"sales\")`.","min_provider_version":"13.0.1","defaults":"name owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.externalLocation":{"id":"databricks.externalLocation","name":"databricks.externalLocation","fields":{"browseOnly":{"name":"browseOnly","type":"\u0004","is_mandatory":true,"title":"Whether the principal is limited to browsing metadata through the BROWSE privilege","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Location comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the location was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the location","provider":"go.mondoo.com/mql/providers/databricks"},"credential":{"name":"credential","type":"\u001bdatabricks.storageCredential","title":"Storage credential used to reach this location","provider":"go.mondoo.com/mql/providers/databricks"},"fallback":{"name":"fallback","type":"\u0004","is_mandatory":true,"title":"Whether access falls back to cluster credentials when Unity Catalog credentials are insufficient","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the location","provider":"go.mondoo.com/mql/providers/databricks"},"isolationMode":{"name":"isolationMode","type":"\u0007","is_mandatory":true,"title":"Isolation mode (ISOLATED or OPEN)","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the location belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Location name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the location","provider":"go.mondoo.com/mql/providers/databricks"},"readOnly":{"name":"readOnly","type":"\u0004","is_mandatory":true,"title":"Whether the location is read-only","provider":"go.mondoo.com/mql/providers/databricks"},"sseEncryptionAlgorithm":{"name":"sseEncryptionAlgorithm","type":"\u0007","is_mandatory":true,"title":"Server-side encryption algorithm applied to the storage path","desc":"One of AWS_SSE_S3 or AWS_SSE_KMS. Empty when no server-side encryption is recorded for the location.","provider":"go.mondoo.com/mql/providers/databricks"},"sseKmsKeyArn":{"name":"sseKmsKeyArn","type":"\u0007","is_mandatory":true,"title":"ARN of the KMS key used for server-side encryption, when the algorithm is AWS_SSE_KMS","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the location was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the location","provider":"go.mondoo.com/mql/providers/databricks"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Storage path URL the location points at","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog external location","desc":"An external location maps a cloud storage path to a storage credential and bounds the reach of Unity Catalog access to that path. Auditing external locations surfaces the storage URL, the credential used to reach it, the isolation mode that controls which workspaces can bind it, whether it is read-only, whether fallback to cluster credentials is allowed, the server-side encryption applied to the path, and the privilege grants assigned on it. Select a location by name, for example `databricks.externalLocations.where(name == \"prod-landing\")`.","min_provider_version":"13.0.1","defaults":"name url owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.globalInitScript":{"id":"databricks.globalInitScript","name":"databricks.globalInitScript","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the script was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the script","provider":"go.mondoo.com/mql/providers/databricks"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the script is enabled and runs on cluster startup","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Script id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Script name","provider":"go.mondoo.com/mql/providers/databricks"},"position":{"name":"position","type":"\u0005","is_mandatory":true,"title":"Run-order position, where 0 is the first script to run","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the script was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the script","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Global init script","desc":"A script that runs on every cluster in the workspace during startup, keyed by its script id. Because it executes on all clusters, an enabled global init script is a persistence and code-execution vector worth auditing. Covers the name, whether it is enabled, its run-order position, and creation and modification metadata. Select a script by id, for example `databricks.globalInitScripts.where(name == \"bootstrap\")`.","min_provider_version":"13.0.1","defaults":"name enabled position","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.grant":{"id":"databricks.grant","name":"databricks.grant","fields":{"principal":{"name":"principal","type":"\u0007","is_mandatory":true,"title":"Principal (user, group, or service principal) the privileges are granted to","provider":"go.mondoo.com/mql/providers/databricks"},"privileges":{"name":"privileges","type":"\u0019\u0007","is_mandatory":true,"title":"Privileges granted to the principal on the securable","provider":"go.mondoo.com/mql/providers/databricks"},"securableName":{"name":"securableName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the securable","provider":"go.mondoo.com/mql/providers/databricks"},"securableType":{"name":"securableType","type":"\u0007","is_mandatory":true,"title":"Type of securable the grant applies to (such as CATALOG or SCHEMA)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog privilege grant","desc":"A set of privileges granted to a single principal on a Unity Catalog securable (a catalog or schema). Covers the principal, the granted privileges (such as SELECT, MODIFY, ALL_PRIVILEGES, or USE_SCHEMA), and the securable the grant applies to.","min_provider_version":"13.0.0","defaults":"principal securableType securableName","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.group":{"id":"databricks.group","name":"databricks.group","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Group name","provider":"go.mondoo.com/mql/providers/databricks"},"entitlements":{"name":"entitlements","type":"\u0019\u0007","is_mandatory":true,"title":"Entitlements granted to the group","provider":"go.mondoo.com/mql/providers/databricks"},"externalId":{"name":"externalId","type":"\u0007","is_mandatory":true,"title":"External identity provider id","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SCIM id","provider":"go.mondoo.com/mql/providers/databricks"},"members":{"name":"members","type":"\u0019\u0007","is_mandatory":true,"title":"Ids of the group's members","provider":"go.mondoo.com/mql/providers/databricks"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Cloud roles granted to the group","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks account group","desc":"A group provisioned in the Databricks account through SCIM, keyed by displayName. Covers the members (users, service principals, and nested groups), the account-level entitlements granted to the group, and cloud roles. Select a group by name, for example `databricks.groups.where(displayName == \"admins\")`.","min_provider_version":"13.0.0","defaults":"displayName","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.instanceProfile":{"id":"databricks.instanceProfile","name":"databricks.instanceProfile","fields":{"iamRoleArn":{"name":"iamRoleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the AWS IAM role associated with the instance profile","provider":"go.mondoo.com/mql/providers/databricks"},"instanceProfileArn":{"name":"instanceProfileArn","type":"\u0007","is_mandatory":true,"title":"ARN of the instance profile registered with Databricks","provider":"go.mondoo.com/mql/providers/databricks"},"isMetaInstanceProfile":{"name":"isMetaInstanceProfile","type":"\u0004","is_mandatory":true,"title":"Whether the profile is a meta instance profile that can assume a wide range of roles","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"AWS instance profile","desc":"An AWS instance profile registered in the workspace that clusters can assume to obtain AWS credentials, keyed by its ARN. This is the legacy instance-profile credential path. A meta instance profile can assume a wide range of roles and warrants closer review. Covers the instance profile ARN, the associated IAM role ARN, and whether it is a meta instance profile. Select a profile by ARN, for example `databricks.instanceProfiles.where(isMetaInstanceProfile == true)`.","min_provider_version":"13.0.1","defaults":"instanceProfileArn isMetaInstanceProfile","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.ipAccessList":{"id":"databricks.ipAccessList","name":"databricks.ipAccessList","fields":{"addressCount":{"name":"addressCount","type":"\u0005","is_mandatory":true,"title":"Number of addresses in the list","provider":"go.mondoo.com/mql/providers/databricks"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the list is enforced","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IP access list id","provider":"go.mondoo.com/mql/providers/databricks"},"ipAddresses":{"name":"ipAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"CIDR ranges in the list","provider":"go.mondoo.com/mql/providers/databricks"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"List label","provider":"go.mondoo.com/mql/providers/databricks"},"listType":{"name":"listType","type":"\u0007","is_mandatory":true,"title":"List type (ALLOW or BLOCK)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks workspace IP access list","desc":"A list of IP ranges allowed or blocked from reaching a workspace, keyed by label. Covers the list type, the CIDR ranges it contains, and whether it is enabled. Select a list by label, for example `databricks.ipAccessLists.where(label == \"office\")`.","min_provider_version":"13.0.0","defaults":"label listType enabled","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.metastore":{"id":"databricks.metastore","name":"databricks.metastore","fields":{"cloud":{"name":"cloud","type":"\u0007","is_mandatory":true,"title":"Hosting cloud","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the metastore was created","provider":"go.mondoo.com/mql/providers/databricks"},"deltaSharingRecipientTokenLifetimeInSeconds":{"name":"deltaSharingRecipientTokenLifetimeInSeconds","type":"\u0005","is_mandatory":true,"title":"Lifetime in seconds of Delta Sharing recipient tokens","provider":"go.mondoo.com/mql/providers/databricks"},"deltaSharingScope":{"name":"deltaSharingScope","type":"\u0007","is_mandatory":true,"title":"Delta Sharing scope","desc":"One of INTERNAL or INTERNAL_AND_EXTERNAL. INTERNAL_AND_EXTERNAL enables open Delta Sharing outside the account.","provider":"go.mondoo.com/mql/providers/databricks"},"externalAccessEnabled":{"name":"externalAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether external engines may read managed tables through open APIs","provider":"go.mondoo.com/mql/providers/databricks"},"globalMetastoreId":{"name":"globalMetastoreId","type":"\u0007","is_mandatory":true,"title":"Global metastore id (cloud:region:id)","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Metastore id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Metastore name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the metastore","provider":"go.mondoo.com/mql/providers/databricks"},"privilegeModelVersion":{"name":"privilegeModelVersion","type":"\u0007","is_mandatory":true,"title":"Unity Catalog privilege model version","provider":"go.mondoo.com/mql/providers/databricks"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Hosting region","provider":"go.mondoo.com/mql/providers/databricks"},"storageRoot":{"name":"storageRoot","type":"\u0007","is_mandatory":true,"title":"Cloud storage root backing the metastore","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog metastore","desc":"A Unity Catalog metastore registered in the account, keyed by name. Covers the owner, hosting cloud and region, storage root, the Delta Sharing scope and recipient token lifetime, and whether external access is enabled. Select a metastore by name, for example `databricks.metastores.where(name == \"primary\")`.","min_provider_version":"13.0.0","defaults":"name owner region","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.modelVersion":{"id":"databricks.modelVersion","name":"databricks.modelVersion","fields":{"aliases":{"name":"aliases","type":"\u0019\n","is_mandatory":true,"title":"Aliases pointing at the version","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Version comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the version was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the version","provider":"go.mondoo.com/mql/providers/databricks"},"modelName":{"name":"modelName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the parent registered model","provider":"go.mondoo.com/mql/providers/databricks"},"runId":{"name":"runId","type":"\u0007","is_mandatory":true,"title":"MLflow run id used when creating the version, empty when not generated by a run","provider":"go.mondoo.com/mql/providers/databricks"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"URI locating the source artifacts for the version","provider":"go.mondoo.com/mql/providers/databricks"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Registration status","desc":"One of PENDING_REGISTRATION, FAILED_REGISTRATION, READY, or MODEL_VERSION_STATUS_UNKNOWN. Only READY versions can be loaded for inference or served.","provider":"go.mondoo.com/mql/providers/databricks"},"storageLocation":{"name":"storageLocation","type":"\u0007","is_mandatory":true,"title":"Cloud storage path under which the version data files are stored","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the version was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Integer version number","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog model version","desc":"A single version of a Unity Catalog registered model, keyed by the parent model's fully qualified name and the version number. Covers the registration status, the source artifact location, the MLflow run that produced it, the storage location backing its files, and the aliases pointing at it.","min_provider_version":"13.0.1","defaults":"modelName version status","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.network":{"id":"databricks.network","name":"databricks.network","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network configuration id","provider":"go.mondoo.com/mql/providers/databricks"},"networkName":{"name":"networkName","type":"\u0007","is_mandatory":true,"title":"Network configuration name","provider":"go.mondoo.com/mql/providers/databricks"},"securityGroupIds":{"name":"securityGroupIds","type":"\u0019\u0007","is_mandatory":true,"title":"Security group ids attached to the network","provider":"go.mondoo.com/mql/providers/databricks"},"subnetIds":{"name":"subnetIds","type":"\u0019\u0007","is_mandatory":true,"title":"Subnet ids attached to the network","provider":"go.mondoo.com/mql/providers/databricks"},"vpcId":{"name":"vpcId","type":"\u0007","is_mandatory":true,"title":"Cloud VPC id","provider":"go.mondoo.com/mql/providers/databricks"},"vpcStatus":{"name":"vpcStatus","type":"\u0007","is_mandatory":true,"title":"VPC validation status","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks account network","desc":"A customer-managed network registered in the account for workspace deployment, keyed by networkName. Covers the cloud network identifiers (VPC, subnets, security groups) and their validation status. Select a network by name, for example `databricks.networks.where(networkName == \"prod-vpc\")`.","min_provider_version":"13.0.0","defaults":"networkName vpcId","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.privateAccessSetting":{"id":"databricks.privateAccessSetting","name":"databricks.privateAccessSetting","fields":{"allowedVpcEndpointIds":{"name":"allowedVpcEndpointIds","type":"\u0019\u0007","is_mandatory":true,"title":"VPC endpoint ids allowed to reach the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Private access settings id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Private access settings name","provider":"go.mondoo.com/mql/providers/databricks"},"privateAccessLevel":{"name":"privateAccessLevel","type":"\u0007","is_mandatory":true,"title":"Private access level","desc":"One of ACCOUNT (any endpoint in the account) or ENDPOINT (only the listed endpoints).","provider":"go.mondoo.com/mql/providers/databricks"},"publicAccessEnabled":{"name":"publicAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the workspace is also reachable over the public internet","provider":"go.mondoo.com/mql/providers/databricks"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Region the settings apply to","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks private access settings","desc":"Private connectivity settings that govern how a workspace is reached over the cloud provider's private network, keyed by name. Covers whether public access is allowed alongside private access, the private access level, and the VPC endpoints permitted to reach the workspace. Select a setting by name, for example `databricks.privateAccessSettings.where(name == \"prod-pas\")`.","min_provider_version":"13.0.0","defaults":"name publicAccessEnabled privateAccessLevel","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.registeredModel":{"id":"databricks.registeredModel","name":"databricks.registeredModel","fields":{"aliases":{"name":"aliases","type":"\u0019\n","is_mandatory":true,"title":"Aliases associated with the model, each pointing at a model version","provider":"go.mondoo.com/mql/providers/databricks"},"browseOnly":{"name":"browseOnly","type":"\u0004","is_mandatory":true,"title":"Whether the principal is limited to browsing metadata through the BROWSE privilege","provider":"go.mondoo.com/mql/providers/databricks"},"catalog":{"name":"catalog","type":"\u001bdatabricks.catalog","title":"Parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"catalogName":{"name":"catalogName","type":"\u0007","is_mandatory":true,"title":"Name of the parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Model comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the model was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the model","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name (catalog.schema.model)","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the model","provider":"go.mondoo.com/mql/providers/databricks"},"modelVersions":{"name":"modelVersions","type":"\u0019\u001bdatabricks.modelVersion","title":"Model versions contained in the model","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Model name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the model","provider":"go.mondoo.com/mql/providers/databricks"},"schema":{"name":"schema","type":"\u001bdatabricks.schema","title":"Parent schema","provider":"go.mondoo.com/mql/providers/databricks"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Name of the parent schema","provider":"go.mondoo.com/mql/providers/databricks"},"storageLocation":{"name":"storageLocation","type":"\u0007","is_mandatory":true,"title":"Cloud storage path under which model version files are stored","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the model was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the model","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog registered model","desc":"A registered model in Unity Catalog, keyed by its three-level fully qualified name (catalog.schema.model). Covers the owner, comment, storage location backing the model version files, the parent catalog and schema, the aliases pointing at model versions, the privilege grants assigned on it, and the model versions it contains. Select a model by full name, for example `databricks.registeredModels.where(name == \"fraud_detector\")`.","min_provider_version":"13.0.1","defaults":"fullName owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.schema":{"id":"databricks.schema","name":"databricks.schema","fields":{"catalog":{"name":"catalog","type":"\u001bdatabricks.catalog","title":"Parent catalog","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"catalogName":{"name":"catalogName","type":"\u0007","is_mandatory":true,"title":"Name of the parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Schema comment","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name (catalog.schema)","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the schema","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Schema id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Schema name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the schema","provider":"go.mondoo.com/mql/providers/databricks"},"volumes":{"name":"volumes","type":"\u0019\u001bdatabricks.volume","title":"Unity Catalog volumes in the schema","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog schema","desc":"A schema within a Unity Catalog catalog, keyed by its fully qualified name (catalog.schema). Covers the owner, the parent catalog, and the privilege grants assigned on it. Select a schema by full name, for example `databricks.catalogs.where(name == \"main\").schemas.where(name == \"sales\")`.","min_provider_version":"13.0.0","defaults":"fullName owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.secretScope":{"id":"databricks.secretScope","name":"databricks.secretScope","fields":{"acls":{"name":"acls","type":"\u001a\u0007\u0007","title":"Access-control list mapping each principal to its permission (MANAGE, READ, or WRITE)","provider":"go.mondoo.com/mql/providers/databricks"},"backendType":{"name":"backendType","type":"\u0007","is_mandatory":true,"title":"Backend storing the secrets (DATABRICKS or AZURE_KEYVAULT)","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Scope name","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks secret scope","desc":"A secret scope in the workspace, keyed by name. Covers the backend storing the secrets (a Databricks-managed store or an Azure Key Vault) and the access-control list mapping each principal to its permission on the scope. Select a scope by name, for example `databricks.secretScopes.where(name == \"prod\")`.","min_provider_version":"13.0.0","defaults":"name backendType","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.servicePrincipal":{"id":"databricks.servicePrincipal","name":"databricks.servicePrincipal","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the service principal is active","provider":"go.mondoo.com/mql/providers/databricks"},"applicationId":{"name":"applicationId","type":"\u0007","is_mandatory":true,"title":"OAuth client id","provider":"go.mondoo.com/mql/providers/databricks"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/providers/databricks"},"entitlements":{"name":"entitlements","type":"\u0019\u0007","is_mandatory":true,"title":"Entitlements granted to the service principal","provider":"go.mondoo.com/mql/providers/databricks"},"externalId":{"name":"externalId","type":"\u0007","is_mandatory":true,"title":"External identity provider id","provider":"go.mondoo.com/mql/providers/databricks"},"groups":{"name":"groups","type":"\u0019\u001bdatabricks.group","title":"Groups the service principal belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SCIM id","provider":"go.mondoo.com/mql/providers/databricks"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Cloud roles granted to the service principal","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks account service principal","desc":"A machine identity provisioned in the Databricks account through SCIM, keyed by applicationId (the OAuth client id). Covers the active state, account-level entitlements, cloud roles, and group memberships. Select a service principal by application id, for example `databricks.servicePrincipals.where(applicationId == \"...\")`.","min_provider_version":"13.0.0","defaults":"displayName applicationId active","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.servingEndpoint":{"id":"databricks.servingEndpoint","name":"databricks.servingEndpoint","fields":{"aiGateway":{"name":"aiGateway","type":"\u001bdatabricks.servingEndpoint.gatewayConfig","title":"AI Gateway governance configured on the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"budgetPolicyId":{"name":"budgetPolicyId","type":"\u0007","is_mandatory":true,"title":"Id of the budget policy associated with the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"configUpdate":{"name":"configUpdate","type":"\u0007","is_mandatory":true,"title":"State of a pending configuration update","desc":"IN_PROGRESS while an update is being applied, UPDATE_FAILED when the last update failed, and NOT_UPDATING when there is no update in progress.","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the endpoint was created","provider":"go.mondoo.com/mql/providers/databricks"},"creator":{"name":"creator","type":"\u0007","is_mandatory":true,"title":"Email of the user that created the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Endpoint description","provider":"go.mondoo.com/mql/providers/databricks"},"gatewayConfig":{"name":"gatewayConfig","type":"\u001bdatabricks.servingEndpoint.gatewayConfig","title":"AI Gateway configuration on a model serving endpoint","is_private":true,"provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"System-generated endpoint id used by the Permissions API","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint name","provider":"go.mondoo.com/mql/providers/databricks"},"routeOptimized":{"name":"routeOptimized","type":"\u0004","title":"Whether route optimization is enabled for the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"servedEntities":{"name":"servedEntities","type":"\u0019\u001bdatabricks.servingEndpoint.servedEntity","title":"Served entities (models) fronted by the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"servedEntity":{"name":"servedEntity","type":"\u001bdatabricks.servingEndpoint.servedEntity","title":"Served entity behind a model serving endpoint","is_private":true,"provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether the endpoint is queryable","desc":"READY when every served entity in the active configuration is ready, NOT_READY when any actively served entity is in a non-ready state.","provider":"go.mondoo.com/mql/providers/databricks"},"tags":{"name":"tags","type":"\u0019\n","is_mandatory":true,"title":"Tags attached to the endpoint, each with a key and value","provider":"go.mondoo.com/mql/providers/databricks"},"task":{"name":"task","type":"\u0007","is_mandatory":true,"title":"Task type served by the endpoint (such as llm/v1/chat or llm/v1/completions)","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the endpoint was last updated by a user","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Mosaic AI model serving endpoint","desc":"A Mosaic AI model serving endpoint in the workspace, keyed by name. Covers the endpoint state and pending configuration update, the creator, the task type, the budget policy, and the creation and update times. The served entities behind the endpoint are exposed through servedEntities, and the AI Gateway governance (usage tracking, inference-table payload logging, guardrails, and rate limits) through aiGateway. Select an endpoint by name, for example `databricks.servingEndpoints.where(name == \"prod-llm\")`.","min_provider_version":"13.0.1","defaults":"name state task","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.servingEndpoint.gatewayConfig":{"id":"databricks.servingEndpoint.gatewayConfig","name":"databricks.servingEndpoint.gatewayConfig","fields":{"fallbackEnabled":{"name":"fallbackEnabled","type":"\u0004","is_mandatory":true,"title":"Whether traffic fallback to other served entities on failure is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"guardrails":{"name":"guardrails","type":"\n","is_mandatory":true,"title":"AI guardrail filters applied to endpoint inputs and outputs","provider":"go.mondoo.com/mql/providers/databricks"},"inferenceTableCatalog":{"name":"inferenceTableCatalog","type":"\u0007","is_mandatory":true,"title":"Unity Catalog catalog holding the inference table","provider":"go.mondoo.com/mql/providers/databricks"},"inferenceTableEnabled":{"name":"inferenceTableEnabled","type":"\u0004","is_mandatory":true,"title":"Whether inference-table payload logging is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"inferenceTableSchema":{"name":"inferenceTableSchema","type":"\u0007","is_mandatory":true,"title":"Unity Catalog schema holding the inference table","provider":"go.mondoo.com/mql/providers/databricks"},"inferenceTableTablePrefix":{"name":"inferenceTableTablePrefix","type":"\u0007","is_mandatory":true,"title":"Prefix of the inference table name in Unity Catalog","provider":"go.mondoo.com/mql/providers/databricks"},"rateLimits":{"name":"rateLimits","type":"\u0019\n","is_mandatory":true,"title":"Rate limits applied to the endpoint, each with calls, renewalPeriod, key, and principal","provider":"go.mondoo.com/mql/providers/databricks"},"usageTrackingEnabled":{"name":"usageTrackingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether operational usage tracking through system tables is enabled","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"AI Gateway configuration on a model serving endpoint","private":true,"min_provider_version":"13.0.1","defaults":"usageTrackingEnabled inferenceTableEnabled","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.servingEndpoint.servedEntity":{"id":"databricks.servingEndpoint.servedEntity","name":"databricks.servingEndpoint.servedEntity","fields":{"entityName":{"name":"entityName","type":"\u0007","is_mandatory":true,"title":"Name of the served Unity Catalog model or entity","provider":"go.mondoo.com/mql/providers/databricks"},"entityVersion":{"name":"entityVersion","type":"\u0007","is_mandatory":true,"title":"Version of the served entity","provider":"go.mondoo.com/mql/providers/databricks"},"externalModelName":{"name":"externalModelName","type":"\u0007","is_mandatory":true,"title":"Name of the served external model, empty when the entity is not an external model","provider":"go.mondoo.com/mql/providers/databricks"},"externalModelProvider":{"name":"externalModelProvider","type":"\u0007","is_mandatory":true,"title":"Provider of the served external model","desc":"One of ai21labs, amazon-bedrock, anthropic, cohere, custom, databricks-model-serving, google-cloud-vertex-ai, openai, or palm. Empty when the entity is not an external model.","provider":"go.mondoo.com/mql/providers/databricks"},"externalModelTask":{"name":"externalModelTask","type":"\u0007","is_mandatory":true,"title":"Task type of the served external model, empty when the entity is not an external model","provider":"go.mondoo.com/mql/providers/databricks"},"foundationModelName":{"name":"foundationModelName","type":"\u0007","is_mandatory":true,"title":"Name of the served Databricks foundation model, empty when the entity is not a foundation model","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the served entity within the endpoint config","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Served entity behind a model serving endpoint","private":true,"min_provider_version":"13.0.1","defaults":"name entityName","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.storageCredential":{"id":"databricks.storageCredential","name":"databricks.storageCredential","fields":{"awsIamRoleArn":{"name":"awsIamRoleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the AWS IAM role the credential assumes","provider":"go.mondoo.com/mql/providers/databricks"},"awsIamRoleExternalId":{"name":"awsIamRoleExternalId","type":"\u0007","is_mandatory":true,"title":"External ID used when assuming the AWS IAM role, which guards against the confused-deputy problem","provider":"go.mondoo.com/mql/providers/databricks"},"azureAccessConnectorId":{"name":"azureAccessConnectorId","type":"\u0007","is_mandatory":true,"title":"Azure resource ID of the Databricks access connector for the managed identity","provider":"go.mondoo.com/mql/providers/databricks"},"azureServicePrincipalApplicationId":{"name":"azureServicePrincipalApplicationId","type":"\u0007","is_mandatory":true,"title":"Application ID of the Azure service principal the credential uses","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Credential comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the credential was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the credential","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the credential","provider":"go.mondoo.com/mql/providers/databricks"},"gcpServiceAccountEmail":{"name":"gcpServiceAccountEmail","type":"\u0007","is_mandatory":true,"title":"Email of the GCP service account the credential uses","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the credential","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the credential","provider":"go.mondoo.com/mql/providers/databricks"},"isolationMode":{"name":"isolationMode","type":"\u0007","is_mandatory":true,"title":"Isolation mode (ISOLATED or OPEN)","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the credential belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Credential name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the credential","provider":"go.mondoo.com/mql/providers/databricks"},"readOnly":{"name":"readOnly","type":"\u0004","is_mandatory":true,"title":"Whether the credential is usable only for read operations","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the credential was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the credential","provider":"go.mondoo.com/mql/providers/databricks"},"usedForManagedStorage":{"name":"usedForManagedStorage","type":"\u0004","is_mandatory":true,"title":"Whether the credential backs the metastore's root managed storage","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog storage credential","desc":"A storage credential holds the cloud identity Unity Catalog assumes to reach external storage: an AWS IAM role, an Azure managed identity or service principal, or a GCP service account. Auditing storage credentials surfaces the vended principal (the AWS role ARN and its external ID, the Azure access connector, the Azure application ID, or the GCP service account email), the isolation mode that controls which workspaces can use it, whether it is read-only or backs the metastore's root managed storage, and the privilege grants assigned on it. Select a credential by name, for example `databricks.storageCredentials.where(name == \"prod-s3\")`.","min_provider_version":"13.0.1","defaults":"name owner isolationMode","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.token":{"id":"databricks.token","name":"databricks.token","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment describing the token","provider":"go.mondoo.com/mql/providers/databricks"},"createdByUsername":{"name":"createdByUsername","type":"\u0007","is_mandatory":true,"title":"Login name of the user that created the token","provider":"go.mondoo.com/mql/providers/databricks"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"Time the token was created","provider":"go.mondoo.com/mql/providers/databricks"},"expiryTime":{"name":"expiryTime","type":"\t","is_mandatory":true,"title":"Time the token expires, null when the token never expires","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Token id","provider":"go.mondoo.com/mql/providers/databricks"},"ownerId":{"name":"ownerId","type":"\u0005","is_mandatory":true,"title":"Numeric id of the user that owns the token","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks personal access token","desc":"A personal access token issued in the workspace, keyed by its token id. Covers the owning user, the creation and expiry times, and the comment set on the token. A token with no expiry never expires and is a standing credential. Select a token by id, for example `databricks.tokens.where(comment == \"ci\")`.","min_provider_version":"13.0.0","defaults":"comment createdByUsername expiryTime","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.user":{"id":"databricks.user","name":"databricks.user","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the user account is active","provider":"go.mondoo.com/mql/providers/databricks"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/providers/databricks"},"emails":{"name":"emails","type":"\u0019\u0007","is_mandatory":true,"title":"Email addresses associated with the user","provider":"go.mondoo.com/mql/providers/databricks"},"entitlements":{"name":"entitlements","type":"\u0019\u0007","is_mandatory":true,"title":"Account-level entitlements granted to the user","provider":"go.mondoo.com/mql/providers/databricks"},"externalId":{"name":"externalId","type":"\u0007","is_mandatory":true,"title":"External identity provider id","provider":"go.mondoo.com/mql/providers/databricks"},"groups":{"name":"groups","type":"\u0019\u001bdatabricks.group","title":"Groups the user belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SCIM id","provider":"go.mondoo.com/mql/providers/databricks"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Cloud roles (such as AWS instance profile ARNs) granted to the user","provider":"go.mondoo.com/mql/providers/databricks"},"userName":{"name":"userName","type":"\u0007","is_mandatory":true,"title":"Login name (email)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks account user","desc":"A user account provisioned in the Databricks account through SCIM, keyed by userName (the login email). Covers the active state, account-level entitlements (such as allow-cluster-create or databricks-sql-access), the cloud roles granted to the user, and group memberships. Select a user by name, for example `databricks.users.where(userName == \"alice@example.com\")`.","min_provider_version":"13.0.0","defaults":"userName active","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.volume":{"id":"databricks.volume","name":"databricks.volume","fields":{"catalog":{"name":"catalog","type":"\u001bdatabricks.catalog","title":"Parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"catalogName":{"name":"catalogName","type":"\u0007","is_mandatory":true,"title":"Name of the parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Volume comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the volume was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the volume","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name (catalog.schema.volume)","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the volume","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the volume","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the volume belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Volume name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the volume","provider":"go.mondoo.com/mql/providers/databricks"},"schema":{"name":"schema","type":"\u001bdatabricks.schema","title":"Parent schema","provider":"go.mondoo.com/mql/providers/databricks"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Name of the parent schema","provider":"go.mondoo.com/mql/providers/databricks"},"sseEncryptionAlgorithm":{"name":"sseEncryptionAlgorithm","type":"\u0007","is_mandatory":true,"title":"Server-side encryption algorithm applied to the storage path","desc":"One of AWS_SSE_S3 or AWS_SSE_KMS. Empty when no server-side encryption is recorded for the volume.","provider":"go.mondoo.com/mql/providers/databricks"},"sseKmsKeyArn":{"name":"sseKmsKeyArn","type":"\u0007","is_mandatory":true,"title":"ARN of the KMS key used for server-side encryption, when the algorithm is AWS_SSE_KMS","provider":"go.mondoo.com/mql/providers/databricks"},"storageLocation":{"name":"storageLocation","type":"\u0007","is_mandatory":true,"title":"Cloud storage path backing an external volume","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the volume was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the volume","provider":"go.mondoo.com/mql/providers/databricks"},"volumeType":{"name":"volumeType","type":"\u0007","is_mandatory":true,"title":"Volume type (EXTERNAL or MANAGED)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog volume","desc":"A Unity Catalog volume governs access to a directory of non-tabular data under a schema, keyed by its fully qualified name. Auditing volumes surfaces the volume type (EXTERNAL volumes live in a cloud storage path outside managed storage, MANAGED volumes live in the schema's default location), the storage location backing an external volume, the server-side encryption applied to it, the owner, and the privilege grants assigned on it. For example `databricks.catalogs.schemas.volumes.where(volumeType == \"EXTERNAL\")`.","min_provider_version":"13.0.1","defaults":"fullName volumeType owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.warehouse":{"id":"databricks.warehouse","name":"databricks.warehouse","fields":{"autoStopMinutes":{"name":"autoStopMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes of inactivity before the warehouse stops, 0 when disabled","provider":"go.mondoo.com/mql/providers/databricks"},"channel":{"name":"channel","type":"\u0007","is_mandatory":true,"title":"Release channel (such as CHANNEL_NAME_CURRENT or CHANNEL_NAME_PREVIEW)","provider":"go.mondoo.com/mql/providers/databricks"},"clusterSize":{"name":"clusterSize","type":"\u0007","is_mandatory":true,"title":"T-shirt size of the warehouse clusters","provider":"go.mondoo.com/mql/providers/databricks"},"creatorName":{"name":"creatorName","type":"\u0007","is_mandatory":true,"title":"Login name of the user that created the warehouse","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Warehouse id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Warehouse name","provider":"go.mondoo.com/mql/providers/databricks"},"photonEnabled":{"name":"photonEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Photon query engine is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"serverlessEnabled":{"name":"serverlessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether serverless compute is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current state (such as RUNNING or STOPPED)","provider":"go.mondoo.com/mql/providers/databricks"},"warehouseType":{"name":"warehouseType","type":"\u0007","is_mandatory":true,"title":"Warehouse type (CLASSIC, PRO, or TYPE_UNSPECIFIED)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks SQL warehouse","desc":"A SQL warehouse in the workspace, keyed by name. Covers the warehouse type, whether Photon and serverless compute are enabled, the release channel, and the current state. Select a warehouse by name, for example `databricks.warehouses.where(name == \"bi\")`.","min_provider_version":"13.0.0","defaults":"name warehouseType state","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.workspace":{"id":"databricks.workspace","name":"databricks.workspace","fields":{"awsRegion":{"name":"awsRegion","type":"\u0007","is_mandatory":true,"title":"AWS region hosting the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"cloud":{"name":"cloud","type":"\u0007","is_mandatory":true,"title":"Hosting cloud (aws, azure, or gcp)","provider":"go.mondoo.com/mql/providers/databricks"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"Time the workspace was created","provider":"go.mondoo.com/mql/providers/databricks"},"customTags":{"name":"customTags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom tags applied to the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"deploymentName":{"name":"deploymentName","type":"\u0007","is_mandatory":true,"title":"Deployment name (the workspace URL subdomain)","provider":"go.mondoo.com/mql/providers/databricks"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"GCP or Azure location hosting the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"managedServicesCustomerManagedKey":{"name":"managedServicesCustomerManagedKey","type":"\u001bdatabricks.customerManagedKey","title":"Customer-managed key protecting control-plane managed services, null when using Databricks-managed keys","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workspace name","provider":"go.mondoo.com/mql/providers/databricks"},"network":{"name":"network","type":"\u001bdatabricks.network","title":"Customer-managed network isolating the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier","desc":"One of COMMUNITY_EDITION, DEDICATED, ENTERPRISE, PREMIUM, STANDARD, or UNKNOWN.","provider":"go.mondoo.com/mql/providers/databricks"},"privateAccessSettings":{"name":"privateAccessSettings","type":"\u001bdatabricks.privateAccessSetting","title":"Private access settings applied to the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Provisioning status","desc":"One of BANNED, CANCELLING, FAILED, NOT_PROVISIONED, PROVISIONING, or RUNNING.","provider":"go.mondoo.com/mql/providers/databricks"},"statusMessage":{"name":"statusMessage","type":"\u0007","is_mandatory":true,"title":"Human-readable detail for the current status","provider":"go.mondoo.com/mql/providers/databricks"},"storageCustomerManagedKey":{"name":"storageCustomerManagedKey","type":"\u001bdatabricks.customerManagedKey","title":"Customer-managed key protecting workspace storage, null when using Databricks-managed keys","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"workspaceId":{"name":"workspaceId","type":"\u0005","is_mandatory":true,"title":"Numeric workspace id","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks workspace","desc":"A workspace registered in the Databricks account, keyed by the numeric workspaceId. Covers the deployment name, provisioning status, pricing tier, hosting cloud and region, the customer-managed keys protecting managed services and storage, and the network and private access settings that isolate the workspace. Select a workspace by id, for example `databricks.workspaces.where(workspaceId == 123456789)`.","min_provider_version":"13.0.0","defaults":"name workspaceId cloud","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.workspaceConf":{"id":"databricks.workspaceConf","name":"databricks.workspaceConf","fields":{"automaticClusterUpdateEnabled":{"name":"automaticClusterUpdateEnabled","type":"\u0004","title":"Whether automatic cluster update is enabled, auto-restarting clusters to apply security updates","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"complianceSecurityProfileEnabled":{"name":"complianceSecurityProfileEnabled","type":"\u0004","title":"Whether the compliance security profile is enabled on the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"complianceSecurityStandards":{"name":"complianceSecurityStandards","type":"\u0019\u0007","title":"Compliance standards selected for the compliance security profile","desc":"Each entry is a standard such as HIPAA, PCI_DSS, FEDRAMP_MODERATE, FEDRAMP_HIGH, FEDRAMP_IL5, IRAP_PROTECTED, CANADA_PROTECTED_B, GERMANY_C5, GERMANY_TISAX, HITRUST, ISMAP, ITAR_EAR, K_FSI, or CYBER_ESSENTIAL_PLUS. Empty when the compliance security profile is not enabled.","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"deprecatedClusterNamedInitScriptsEnabled":{"name":"deprecatedClusterNamedInitScriptsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether legacy cluster-named init scripts are enabled","provider":"go.mondoo.com/mql/providers/databricks"},"deprecatedGlobalInitScriptsEnabled":{"name":"deprecatedGlobalInitScriptsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether legacy global init scripts are enabled","provider":"go.mondoo.com/mql/providers/databricks"},"disableLegacyAccess":{"name":"disableLegacyAccess","type":"\u0004","title":"Whether legacy access to the workspace is disabled","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"enhancedSecurityMonitoringEnabled":{"name":"enhancedSecurityMonitoringEnabled","type":"\u0004","title":"Whether enhanced security monitoring is enabled on the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"ipAccessListsEnabled":{"name":"ipAccessListsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether IP access lists are enforced for the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"maxTokenLifetimeDays":{"name":"maxTokenLifetimeDays","type":"\u0005","is_mandatory":true,"title":"Maximum lifetime in days for newly created personal access tokens","provider":"go.mondoo.com/mql/providers/databricks"},"restrictWorkspaceAdminsStatus":{"name":"restrictWorkspaceAdminsStatus","type":"\u0007","title":"Workspace admin restriction status","desc":"One of ALLOW_ALL or RESTRICT_TOKENS_AND_JOB_RUN_AS. RESTRICT_TOKENS_AND_JOB_RUN_AS limits what workspace admins may do with personal access tokens and job run-as identities.","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"storeInteractiveNotebookResultsInCustomerAccount":{"name":"storeInteractiveNotebookResultsInCustomerAccount","type":"\u0004","is_mandatory":true,"title":"Whether interactive notebook results are stored in the customer's account","provider":"go.mondoo.com/mql/providers/databricks"},"tokensEnabled":{"name":"tokensEnabled","type":"\u0004","is_mandatory":true,"title":"Whether personal access tokens may be created in the workspace","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks workspace security settings","desc":"Security-relevant workspace configuration read from the workspace conf, such as whether personal access tokens are permitted, the maximum token lifetime, whether IP access lists are enforced, and whether legacy global init scripts are enabled. A field is null when the corresponding conf key is unset.","min_provider_version":"13.0.0","defaults":"tokensEnabled ipAccessListsEnabled","provider":"go.mondoo.com/mql/providers/databricks"}}}