{"resources":{"databricks":{"id":"databricks","name":"databricks","fields":{"appIntegration":{"name":"appIntegration","type":"\u001bdatabricks.appIntegration","title":"OAuth app integration","desc":"An OAuth application registered in the account, keyed by its integration id. These are the applications permitted to obtain tokens against the account on a user's behalf. Auditing them surfaces the redirect URLs a token can be returned to, the scopes an app may request, whether the app holds a client secret, and the token lifetimes it is issued. Select an integration by name, for example `databricks.appIntegrations.where(name == \"internal-portal\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"appIntegrations":{"name":"appIntegrations","type":"\u0019\u001bdatabricks.appIntegration","title":"OAuth app integrations registered in the account","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"artifactAllowlist":{"name":"artifactAllowlist","type":"\u001bdatabricks.artifactAllowlist","title":"Unity Catalog artifact allowlist","desc":"The set of artifacts a metastore permits on compute running in a shared access mode, keyed by artifact type. Shared-access clusters refuse init scripts and libraries that are not allowlisted, which is what keeps one user's code from running in another user's session, so an empty allowlist for a type means nothing of that type may load. Select an allowlist by type, for example `databricks.artifactAllowlists.where(artifactType == \"INIT_SCRIPT\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"artifactAllowlists":{"name":"artifactAllowlists","type":"\u0019\u001bdatabricks.artifactAllowlist","title":"Artifact allowlists governing what shared-access clusters may load","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"catalog":{"name":"catalog","type":"\u001bdatabricks.catalog","title":"Unity Catalog catalog","desc":"A Unity Catalog catalog accessible from the workspace, keyed by name. Covers the owner, the metastore it belongs to, the isolation mode that controls which workspaces can bind it, the schemas it contains, and the privilege grants assigned on it. Select a catalog by name, for example `databricks.catalogs.where(name == \"main\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"catalogs":{"name":"catalogs","type":"\u0019\u001bdatabricks.catalog","title":"Unity Catalog catalogs accessible from the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"cluster":{"name":"cluster","type":"\u001bdatabricks.cluster","title":"Databricks compute cluster","desc":"A compute cluster in the workspace, keyed by its cluster id. Covers the data security mode that governs Unity Catalog isolation, the Spark runtime and configuration, local disk encryption, the auto-termination window, and the policy the cluster was created against. Select a cluster by id, for example `databricks.clusters.where(clusterName == \"shared\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"clusterPolicies":{"name":"clusterPolicies","type":"\u0019\u001bdatabricks.clusterPolicy","title":"Cluster policies configured in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"clusterPolicy":{"name":"clusterPolicy","type":"\u001bdatabricks.clusterPolicy","title":"Databricks cluster policy","desc":"A cluster policy in the workspace that constrains the attributes of clusters created against it, keyed by name. Covers the JSON policy document, the per-user cluster cap, and whether the policy is the workspace default. Select a policy by name, for example `databricks.clusterPolicies.where(name == \"job-only\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"clusterSpec":{"name":"clusterSpec","type":"\u001bdatabricks.clusterSpec","title":"Compute specification of a job or pipeline","desc":"The cluster definition a job task or pipeline creates for each run, as opposed to a long-lived cluster in databricks.cluster. Covers the access mode that decides whether the compute can reach Unity Catalog data, the Spark configuration and environment variables that may carry secrets, the init scripts and container image the compute boots, the cloud identity it assumes, and the cluster policy constraining it.","is_private":true,"provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"clusters":{"name":"clusters","type":"\u0019\u001bdatabricks.cluster","title":"Compute clusters in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"connection":{"name":"connection","type":"\u001bdatabricks.connection","title":"Unity Catalog connection","desc":"A connection registers an external data system that Unity Catalog queries through, keyed by name. Connections are the outbound edge of the workspace: a foreign catalog reading from Snowflake, Redshift, PostgreSQL, or BigQuery, or an HTTP connection reaching an arbitrary endpoint. Auditing connections surfaces the system type, the destination URL and connection options, the kind of credential the connection authenticates with, the owner, whether the connection is read-only, the privilege grants assigned on it, and the workspaces it is bound to. Select a connection by name, for example `databricks.connections.where(name == \"snowflake-prod\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"connections":{"name":"connections","type":"\u0019\u001bdatabricks.connection","title":"Unity Catalog connections to external data systems","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"credential":{"name":"credential","type":"\u001bdatabricks.credential","title":"Unity Catalog credential","desc":"A credential holds the cloud identity Unity Catalog assumes to reach a resource outside Databricks, keyed by name. The purpose field separates the two kinds: STORAGE credentials reach cloud object storage and are the same objects surfaced by storageCredentials, while SERVICE credentials reach other cloud services and are only available here. Auditing credentials surfaces the vended principal (the AWS IAM role ARN and its external ID, the Azure access connector and managed identity, the Azure application ID, or the GCP service account email), the isolation mode and the workspaces bound under it, whether the credential is read-only or backs the metastore's root managed storage, and the privilege grants assigned on it. Select a credential by name, for example `databricks.credentials.where(name == \"prod-lambda\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"credentialConfiguration":{"name":"credentialConfiguration","type":"\u001bdatabricks.credentialConfiguration","title":"Account credential configuration","desc":"A cross-account role the Databricks control plane assumes to manage resources in the customer's cloud account, keyed by its configuration id. This is the standing grant that lets Databricks create compute and reach storage on the account's behalf. Select a configuration by name, for example `databricks.credentialConfigurations.where(name == \"prod-role\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"credentialConfigurations":{"name":"credentialConfigurations","type":"\u0019\u001bdatabricks.credentialConfiguration","title":"Cross-account credential configurations the account assumes","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"credentials":{"name":"credentials","type":"\u0019\u001bdatabricks.credential","title":"Unity Catalog credentials in the workspace's metastore","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"customerManagedKey":{"name":"customerManagedKey","type":"\u001bdatabricks.customerManagedKey","title":"Customer-managed encryption key","desc":"An encryption key registered in the account for protecting workspace managed services or storage, keyed by its configuration id. Covers the use cases the key applies to (MANAGED_SERVICES for control-plane notebooks, secrets, and query history, STORAGE for the workspace root bucket and, optionally, cluster EBS volumes), the creation time, and the cloud key identifiers (the AWS KMS key ARN, alias, and region, or the GCP KMS key resource id). Select a key by id, for example `databricks.customerManagedKeys.where(id == \"...\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"customerManagedKeys":{"name":"customerManagedKeys","type":"\u0019\u001bdatabricks.customerManagedKey","title":"Customer-managed encryption keys registered in the account","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"deltaSharingRecipient":{"name":"deltaSharingRecipient","type":"\u001bdatabricks.deltaSharingRecipient","title":"Delta Sharing recipient","desc":"A recipient that workspace data is shared with through Delta Sharing, keyed by name. Covers the authentication type (TOKEN for open sharing secured by a bearer token, DATABRICKS for Databricks-to-Databricks sharing between metastores), whether the recipient has been activated, the owner and comment, the data recipient's global metastore id for Databricks-to-Databricks sharing, the IP access list restricting where the recipient may connect from, and non-secret metadata for each issued token. Token secret values and activation URLs are never exposed. Select a recipient by name, for example `databricks.deltaSharingRecipients.where(name == \"partner\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"deltaSharingRecipients":{"name":"deltaSharingRecipients","type":"\u0019\u001bdatabricks.deltaSharingRecipient","title":"Delta Sharing recipients configured in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"deltaSharingShare":{"name":"deltaSharingShare","type":"\u001bdatabricks.deltaSharingShare","title":"Delta Sharing share","desc":"A share, a named collection of data objects made available to Delta Sharing recipients, keyed by name. Covers the owner, comment, the data objects included in the share, and creation and modification metadata. Select a share by name, for example `databricks.deltaSharingShares.where(name == \"sales\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"deltaSharingShares":{"name":"deltaSharingShares","type":"\u0019\u001bdatabricks.deltaSharingShare","title":"Delta Sharing shares configured in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"externalLocation":{"name":"externalLocation","type":"\u001bdatabricks.externalLocation","title":"Unity Catalog external location","desc":"An external location maps a cloud storage path to a storage credential and bounds the reach of Unity Catalog access to that path. Auditing external locations surfaces the storage URL, the credential used to reach it, the isolation mode that controls which workspaces can bind it, whether it is read-only, whether fallback to cluster credentials is allowed, the server-side encryption applied to the path, and the privilege grants assigned on it. Select a location by name, for example `databricks.externalLocations.where(name == \"prod-landing\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"externalLocations":{"name":"externalLocations","type":"\u0019\u001bdatabricks.externalLocation","title":"Unity Catalog external locations in the workspace's metastore","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"federationPolicies":{"name":"federationPolicies","type":"\u0019\u001bdatabricks.federationPolicy","title":"Account-level OIDC federation policies","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"federationPolicy":{"name":"federationPolicy","type":"\u001bdatabricks.federationPolicy","title":"OIDC federation policy","desc":"A policy that lets a workload outside Databricks exchange an OIDC token for Databricks access without a stored secret, keyed by its policy id. The policy names the issuer it trusts, the audiences it accepts, and the subject it binds to, so it defines exactly which external identity can authenticate. An account policy applies to the whole account; a policy attached to a service principal authenticates as that principal. A policy with a broad subject claim admits more external workloads than intended. Select a policy by name, for example `databricks.federationPolicies.where(name == \"github-actions\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"gitCredential":{"name":"gitCredential","type":"\u001bdatabricks.gitCredential","title":"Git provider credential","desc":"A credential the workspace stores to authenticate against a Git hosting provider, keyed by its numeric id. These credentials let jobs and Git folders reach private repositories, so auditing them surfaces which providers the workspace can authenticate to and under which account. The token itself is write-only in the API and is never returned. Select a credential by provider, for example `databricks.gitCredentials.where(gitProvider == \"gitHub\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"gitCredentials":{"name":"gitCredentials","type":"\u0019\u001bdatabricks.gitCredential","title":"Git provider credentials stored in the workspace","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"globalInitScript":{"name":"globalInitScript","type":"\u001bdatabricks.globalInitScript","title":"Global init script","desc":"A script that runs on every cluster in the workspace during startup, keyed by its script id. Because it executes on all clusters, an enabled global init script is a persistence and code-execution vector worth auditing. Covers the name, whether it is enabled, its run-order position, and creation and modification metadata. Select a script by id, for example `databricks.globalInitScripts.where(name == \"bootstrap\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"globalInitScripts":{"name":"globalInitScripts","type":"\u0019\u001bdatabricks.globalInitScript","title":"Global init scripts that run on every cluster in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"grant":{"name":"grant","type":"\u001bdatabricks.grant","title":"Unity Catalog privilege grant","desc":"A set of privileges granted to a single principal on a Unity Catalog securable (a catalog or schema). Covers the principal, the granted privileges (such as SELECT, MODIFY, ALL_PRIVILEGES, or USE_SCHEMA), and the securable the grant applies to.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"group":{"name":"group","type":"\u001bdatabricks.group","title":"Databricks account group","desc":"A group provisioned in the Databricks account through SCIM, keyed by displayName. Covers the members (users, service principals, and nested groups), the account-level entitlements granted to the group, and cloud roles. Select a group by name, for example `databricks.groups.where(displayName == \"admins\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"groups":{"name":"groups","type":"\u0019\u001bdatabricks.group","title":"Account groups provisioned through SCIM","provider":"go.mondoo.com/mql/providers/databricks"},"instancePool":{"name":"instancePool","type":"\u001bdatabricks.instancePool","title":"Databricks instance pool","desc":"A pool of idle cloud instances that clusters draw nodes from, keyed by its pool id. A pool fixes node-level settings for every cluster that attaches to it, so the AWS instance profile, the preloaded container images, and the custom tags recorded here apply to workloads the pool's own definition never names. Select a pool by name, for example `databricks.instancePools.where(name == \"shared-pool\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"instancePools":{"name":"instancePools","type":"\u0019\u001bdatabricks.instancePool","title":"Instance pools backing the workspace's compute","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"instanceProfile":{"name":"instanceProfile","type":"\u001bdatabricks.instanceProfile","title":"AWS instance profile","desc":"An AWS instance profile registered in the workspace that clusters can assume to obtain AWS credentials, keyed by its ARN. This is the legacy instance-profile credential path. A meta instance profile can assume a wide range of roles and warrants closer review. Covers the instance profile ARN, the associated IAM role ARN, and whether it is a meta instance profile. Select a profile by ARN, for example `databricks.instanceProfiles.where(isMetaInstanceProfile == true)`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"instanceProfiles":{"name":"instanceProfiles","type":"\u0019\u001bdatabricks.instanceProfile","title":"AWS instance profiles registered in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"ipAccessList":{"name":"ipAccessList","type":"\u001bdatabricks.ipAccessList","title":"Databricks workspace IP access list","desc":"A list of IP ranges allowed or blocked from reaching a workspace, keyed by label. Covers the list type, the CIDR ranges it contains, and whether it is enabled. Select a list by label, for example `databricks.ipAccessLists.where(label == \"office\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"ipAccessLists":{"name":"ipAccessLists","type":"\u0019\u001bdatabricks.ipAccessList","title":"IP access lists configured on the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"job":{"name":"job","type":"\u001bdatabricks.job","title":"Databricks job","desc":"A job in the workspace, keyed by the numeric jobId. A job runs one or more tasks on a schedule or trigger under a single fixed identity, which makes it the main scheduled code-execution surface of a workspace. Covers the identity the job runs as, the schedule and its pause state, the concurrency and timeout limits, the Git remote that task source is pulled from, the notification targets that receive run outcomes, whether the job is managed by a deployment bundle, and the workspace access control list. Select a job by id, for example `databricks.jobs.where(id == 620813104278135)`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"jobs":{"name":"jobs","type":"\u0019\u001bdatabricks.job","title":"Jobs defined in the workspace","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"logDelivery":{"name":"logDelivery","type":"\u001bdatabricks.logDelivery","title":"Log delivery configuration","desc":"A configuration that ships account logs to customer-owned cloud storage, keyed by its configuration id. The logType field separates the two kinds: AUDIT_LOGS carries the record of workspace and account activity, and BILLABLE_USAGE carries consumption. Auditing these answers whether audit logging is turned on at all, where the logs land, which workspaces are covered, and whether delivery is actually succeeding. Select a configuration by log type, for example `databricks.logDeliveryConfigurations.where(logType == \"AUDIT_LOGS\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"logDeliveryConfigurations":{"name":"logDeliveryConfigurations","type":"\u0019\u001bdatabricks.logDelivery","title":"Log delivery configurations shipping audit and billable-usage logs out of the account","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"metastore":{"name":"metastore","type":"\u001bdatabricks.metastore","title":"Unity Catalog metastore","desc":"A Unity Catalog metastore registered in the account, keyed by name. Covers the owner, hosting cloud and region, storage root, the Delta Sharing scope and recipient token lifetime, and whether external access is enabled. Select a metastore by name, for example `databricks.metastores.where(name == \"primary\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"metastores":{"name":"metastores","type":"\u0019\u001bdatabricks.metastore","title":"Unity Catalog metastores in the account","provider":"go.mondoo.com/mql/providers/databricks"},"modelVersion":{"name":"modelVersion","type":"\u001bdatabricks.modelVersion","title":"Unity Catalog model version","desc":"A single version of a Unity Catalog registered model, keyed by the parent model's fully qualified name and the version number. Covers the registration status, the source artifact location, the MLflow run that produced it, the storage location backing its files, and the aliases pointing at it.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"network":{"name":"network","type":"\u001bdatabricks.network","title":"Databricks account network","desc":"A customer-managed network registered in the account for workspace deployment, keyed by networkName. Covers the cloud network identifiers (VPC, subnets, security groups) and their validation status. Select a network by name, for example `databricks.networks.where(networkName == \"prod-vpc\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"networkPolicies":{"name":"networkPolicies","type":"\u0019\u001bdatabricks.networkPolicy","title":"Serverless egress network policies in the account","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"networkPolicy":{"name":"networkPolicy","type":"\u001bdatabricks.networkPolicy","title":"Account network policy","desc":"The egress firewall applied to serverless compute in the account, keyed by its policy id. Serverless workloads run outside the customer's network, so this policy is what bounds where they may reach; without it a notebook on serverless compute can call any internet destination. Auditing it surfaces the restriction mode, the destinations explicitly allowed or blocked, and whether the policy is enforced or only logging. Select a policy by id, for example `databricks.networkPolicies.where(id == \"np-1\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"networks":{"name":"networks","type":"\u0019\u001bdatabricks.network","title":"Customer-managed networks registered in the account","provider":"go.mondoo.com/mql/providers/databricks"},"permission":{"name":"permission","type":"\u001bdatabricks.permission","title":"Workspace access control entry","desc":"A single permission level held by one principal on one workspace object such as a cluster, cluster policy, SQL warehouse, job, pipeline, or model serving endpoint. Workspace access control is separate from Unity Catalog privileges, which are covered by databricks.grant, and governs who may view, run, attach to, restart, or manage an object rather than who may read its data. Covers the principal and its kind, the permission level, and whether the level is held directly or comes from a parent object.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"pipeline":{"name":"pipeline","type":"\u001bdatabricks.pipeline","title":"Delta Live Tables pipeline","desc":"A declarative data-processing pipeline in the workspace, keyed by pipelineId. A pipeline runs its libraries as code on compute it creates, which makes it the second scheduled execution surface of a workspace alongside databricks.job. Covers the identity the pipeline runs as, whether it publishes into Unity Catalog or into a storage location outside it, the runtime channel and edition, whether it runs in development mode, the libraries it executes, the compute it creates, and the workspace access control list. Select a pipeline by id, for example `databricks.pipelines.where(id == \"a1b2c3d4-0000-1111-2222-333344445555\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"pipelines":{"name":"pipelines","type":"\u0019\u001bdatabricks.pipeline","title":"Delta Live Tables pipelines defined in the workspace","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"privateAccessSetting":{"name":"privateAccessSetting","type":"\u001bdatabricks.privateAccessSetting","title":"Databricks private access settings","desc":"Private connectivity settings that govern how a workspace is reached over the cloud provider's private network, keyed by name. Covers whether public access is allowed alongside private access, the private access level, and the VPC endpoints permitted to reach the workspace. Select a setting by name, for example `databricks.privateAccessSettings.where(name == \"prod-pas\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"privateAccessSettings":{"name":"privateAccessSettings","type":"\u0019\u001bdatabricks.privateAccessSetting","title":"Private access settings registered in the account","provider":"go.mondoo.com/mql/providers/databricks"},"registeredModel":{"name":"registeredModel","type":"\u001bdatabricks.registeredModel","title":"Unity Catalog registered model","desc":"A registered model in Unity Catalog, keyed by its three-level fully qualified name (catalog.schema.model). Covers the owner, comment, storage location backing the model version files, the parent catalog and schema, the aliases pointing at model versions, the privilege grants assigned on it, and the model versions it contains. Select a model by full name, for example `databricks.registeredModels.where(name == \"fraud_detector\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"registeredModels":{"name":"registeredModels","type":"\u0019\u001bdatabricks.registeredModel","title":"Unity Catalog registered models in the workspace's metastore","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"repo":{"name":"repo","type":"\u001bdatabricks.repo","title":"Git folder in the workspace","desc":"A Git repository checked out into the workspace, keyed by its numeric id. Git folders are how external source enters the workspace, so auditing them surfaces the remote URL and hosting provider, the branch and commit the checkout currently sits on, the workspace path the code is mounted at, the sparse-checkout patterns limiting what is pulled, and the access control list governing who can change any of it. Select a folder by path, for example `databricks.repos.where(path == \"/Repos/prod/etl\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"repos":{"name":"repos","type":"\u0019\u001bdatabricks.repo","title":"Git folders checked out into the workspace","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"schema":{"name":"schema","type":"\u001bdatabricks.schema","title":"Unity Catalog schema","desc":"A schema within a Unity Catalog catalog, keyed by its fully qualified name (catalog.schema). Covers the owner, the parent catalog, and the privilege grants assigned on it. Select a schema by full name, for example `databricks.catalogs.where(name == \"main\").schemas.where(name == \"sales\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"secretScope":{"name":"secretScope","type":"\u001bdatabricks.secretScope","title":"Databricks secret scope","desc":"A secret scope in the workspace, keyed by name. Covers the backend storing the secrets (a Databricks-managed store or an Azure Key Vault) and the access-control list mapping each principal to its permission on the scope. Select a scope by name, for example `databricks.secretScopes.where(name == \"prod\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"secretScopes":{"name":"secretScopes","type":"\u0019\u001bdatabricks.secretScope","title":"Secret scopes configured in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"servicePrincipal":{"name":"servicePrincipal","type":"\u001bdatabricks.servicePrincipal","title":"Databricks account service principal","desc":"A machine identity provisioned in the Databricks account through SCIM, keyed by applicationId (the OAuth client id). Covers the active state, account-level entitlements, cloud roles, and group memberships. Select a service principal by application id, for example `databricks.servicePrincipals.where(applicationId == \"...\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"servicePrincipals":{"name":"servicePrincipals","type":"\u0019\u001bdatabricks.servicePrincipal","title":"Account service principals provisioned through SCIM","provider":"go.mondoo.com/mql/providers/databricks"},"servingEndpoint":{"name":"servingEndpoint","type":"\u001bdatabricks.servingEndpoint","title":"Mosaic AI model serving endpoint","desc":"A Mosaic AI model serving endpoint in the workspace, keyed by name. Covers the endpoint state and pending configuration update, the creator, the task type, the budget policy, and the creation and update times. The served entities behind the endpoint are exposed through servedEntities, and the AI Gateway governance (usage tracking, inference-table payload logging, guardrails, and rate limits) through aiGateway. Select an endpoint by name, for example `databricks.servingEndpoints.where(name == \"prod-llm\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"servingEndpoints":{"name":"servingEndpoints","type":"\u0019\u001bdatabricks.servingEndpoint","title":"Mosaic AI model serving endpoints in the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"storageConfiguration":{"name":"storageConfiguration","type":"\u001bdatabricks.storageConfiguration","title":"Account storage configuration","desc":"A cloud storage bucket the account writes to, keyed by its configuration id. Workspace root storage and log delivery both target one of these, so the bucket named here is where workspace data or the account's audit record lands. Select a configuration by name, for example `databricks.storageConfigurations.where(name == \"audit-logs\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"storageConfigurations":{"name":"storageConfigurations","type":"\u0019\u001bdatabricks.storageConfiguration","title":"Storage configurations log delivery and workspaces write to","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"storageCredential":{"name":"storageCredential","type":"\u001bdatabricks.storageCredential","title":"Unity Catalog storage credential","desc":"A storage credential holds the cloud identity Unity Catalog assumes to reach external storage: an AWS IAM role, an Azure managed identity or service principal, or a GCP service account. Auditing storage credentials surfaces the vended principal (the AWS role ARN and its external ID, the Azure access connector, the Azure application ID, or the GCP service account email), the isolation mode that controls which workspaces can use it, whether it is read-only or backs the metastore's root managed storage, and the privilege grants assigned on it. Select a credential by name, for example `databricks.storageCredentials.where(name == \"prod-s3\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"storageCredentials":{"name":"storageCredentials","type":"\u0019\u001bdatabricks.storageCredential","title":"Unity Catalog storage credentials in the workspace's metastore","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"systemSchema":{"name":"systemSchema","type":"\u001bdatabricks.systemSchema","title":"Unity Catalog system schema","desc":"A schema of the `system` catalog, which Databricks populates with operational data about the metastore, keyed by schema name. Each schema is enabled separately, so this reports which ones are turned on: `access` holds the audit log of workspace and Unity Catalog activity, `billing` holds usage and pricing, `compute` holds cluster and warehouse events, and `lakeflow` holds job run history. Select a schema by name, for example `databricks.systemSchemas.where(schema == \"access\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"systemSchemas":{"name":"systemSchemas","type":"\u0019\u001bdatabricks.systemSchema","title":"Unity Catalog system schemas in the workspace's metastore","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"token":{"name":"token","type":"\u001bdatabricks.token","title":"Databricks personal access token","desc":"A personal access token issued in the workspace, keyed by its token id. Covers the owning user, the creation and expiry times, and the comment set on the token. A token with no expiry never expires and is a standing credential. Select a token by id, for example `databricks.tokens.where(comment == \"ci\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"tokens":{"name":"tokens","type":"\u0019\u001bdatabricks.token","title":"Personal access tokens issued in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"user":{"name":"user","type":"\u001bdatabricks.user","title":"Databricks account user","desc":"A user account provisioned in the Databricks account through SCIM, keyed by userName (the login email). Covers the active state, account-level entitlements (such as allow-cluster-create or databricks-sql-access), the cloud roles granted to the user, and group memberships. Select a user by name, for example `databricks.users.where(userName == \"alice@example.com\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bdatabricks.user","title":"Account users provisioned through SCIM","provider":"go.mondoo.com/mql/providers/databricks"},"volume":{"name":"volume","type":"\u001bdatabricks.volume","title":"Unity Catalog volume","desc":"A Unity Catalog volume governs access to a directory of non-tabular data under a schema, keyed by its fully qualified name. Auditing volumes surfaces the volume type (EXTERNAL volumes live in a cloud storage path outside managed storage, MANAGED volumes live in the schema's default location), the storage location backing an external volume, the server-side encryption applied to it, the owner, and the privilege grants assigned on it. For example `databricks.catalogs.schemas.volumes.where(volumeType == \"EXTERNAL\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"warehouse":{"name":"warehouse","type":"\u001bdatabricks.warehouse","title":"Databricks SQL warehouse","desc":"A SQL warehouse in the workspace, keyed by name. Covers the warehouse type, whether Photon and serverless compute are enabled, the release channel, and the current state. Select a warehouse by name, for example `databricks.warehouses.where(name == \"bi\")`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"warehouses":{"name":"warehouses","type":"\u0019\u001bdatabricks.warehouse","title":"SQL warehouses in the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"workspace":{"name":"workspace","type":"\u001bdatabricks.workspace","title":"Databricks workspace","desc":"A workspace registered in the Databricks account, keyed by the numeric workspaceId. Covers the deployment name, provisioning status, pricing tier, hosting cloud and region, the customer-managed keys protecting managed services and storage, and the network and private access settings that isolate the workspace. Select a workspace by id, for example `databricks.workspaces.where(workspaceId == 123456789)`.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"workspaceAssignment":{"name":"workspaceAssignment","type":"\u001bdatabricks.workspaceAssignment","title":"Workspace access assignment","desc":"A principal's access to a single workspace, assigned at the account level rather than inside the workspace. Covers who the principal is and whether they hold workspace admin. Account-level assignment is how a principal reaches a workspace at all, so a principal absent here has no access to it regardless of any in-workspace grant.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"workspaceConf":{"name":"workspaceConf","type":"\u001bdatabricks.workspaceConf","title":"Databricks workspace security settings","desc":"Security-relevant workspace configuration read from the workspace conf, such as whether personal access tokens are permitted, the maximum token lifetime, whether IP access lists are enforced, and whether legacy global init scripts are enabled. A field is null when the corresponding conf key is unset.","provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"workspaceSettings":{"name":"workspaceSettings","type":"\u001bdatabricks.workspaceConf","title":"Security-relevant configuration of the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"workspaces":{"name":"workspaces","type":"\u0019\u001bdatabricks.workspace","title":"Workspaces registered in the account","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks","desc":"Entry point to a Databricks account and its workspaces. Connecting to the account console exposes account-level identity and networking through the users, groups, servicePrincipals, metastores, networks, privateAccessSettings, and customerManagedKeys fields, and enumerates every workspace through the workspaces field. Connecting to a single workspace exposes that workspace's security surface through the ipAccessLists, workspaceSettings, tokens, secretScopes, clusters, clusterPolicies, warehouses, catalogs, storageCredentials, credentials, connections, externalLocations, systemSchemas, deltaSharingRecipients, deltaSharingShares, globalInitScripts, instanceProfiles, servingEndpoints, and registeredModels fields.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.appIntegration":{"id":"databricks.appIntegration","name":"databricks.appIntegration","fields":{"accessTokenTtlMinutes":{"name":"accessTokenTtlMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes an issued access token remains valid, 0 when the account default applies","provider":"go.mondoo.com/mql/providers/databricks"},"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"OAuth client id of the application","provider":"go.mondoo.com/mql/providers/databricks"},"confidential":{"name":"confidential","type":"\u0004","is_mandatory":true,"title":"Whether the app authenticates with a client secret","desc":"A confidential app holds a secret and can use the authorization code flow with client authentication. A public app holds none and relies on PKCE.","provider":"go.mondoo.com/mql/providers/databricks"},"createTime":{"name":"createTime","type":"\u0007","is_mandatory":true,"title":"When the integration was created","provider":"go.mondoo.com/mql/providers/databricks"},"creatorUsername":{"name":"creatorUsername","type":"\u0007","is_mandatory":true,"title":"Login name of the user that registered the integration","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Integration id","provider":"go.mondoo.com/mql/providers/databricks"},"integrationType":{"name":"integrationType","type":"\u0007","is_mandatory":true,"title":"Whether the app is registered by the account or published by Databricks","desc":"CUSTOM for an application the account registered, PUBLISHED for a Databricks-published application enabled in the account. Published integrations carry no redirect URLs or scopes of their own, so those fields are empty for them.","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Integration name","provider":"go.mondoo.com/mql/providers/databricks"},"redirectUrls":{"name":"redirectUrls","type":"\u0019\u0007","is_mandatory":true,"title":"URLs an authorization response may be returned to","desc":"Every URL here is a place an issued code or token can be delivered, so a loosely scoped entry widens where account credentials can land.","provider":"go.mondoo.com/mql/providers/databricks"},"refreshTokenTtlMinutes":{"name":"refreshTokenTtlMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes an issued refresh token remains valid, 0 when the account default applies","provider":"go.mondoo.com/mql/providers/databricks"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes the application may request","provider":"go.mondoo.com/mql/providers/databricks"},"singleUseRefreshTokens":{"name":"singleUseRefreshTokens","type":"\u0004","is_mandatory":true,"title":"Whether a refresh token is invalidated after a single use","provider":"go.mondoo.com/mql/providers/databricks"},"userAuthorizedScopes":{"name":"userAuthorizedScopes","type":"\u0019\u0007","is_mandatory":true,"title":"Scopes a user may additionally authorize at consent time","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"OAuth app integration","desc":"An OAuth application registered in the account, keyed by its integration id. These are the applications permitted to obtain tokens against the account on a user's behalf. Auditing them surfaces the redirect URLs a token can be returned to, the scopes an app may request, whether the app holds a client secret, and the token lifetimes it is issued. Select an integration by name, for example `databricks.appIntegrations.where(name == \"internal-portal\")`.","min_provider_version":"13.1.4","defaults":"name integrationType clientId","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.artifactAllowlist":{"id":"databricks.artifactAllowlist","name":"databricks.artifactAllowlist","fields":{"artifactType":{"name":"artifactType","type":"\u0007","is_mandatory":true,"title":"Kind of artifact the allowlist governs","desc":"One of INIT_SCRIPT, LIBRARY_JAR, or LIBRARY_MAVEN.","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the allowlist was last set","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who last set the allowlist","provider":"go.mondoo.com/mql/providers/databricks"},"matchers":{"name":"matchers","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Permitted artifacts, keyed by the artifact path or coordinate","desc":"Each key is a storage path, volume path, or Maven coordinate, and its value is how the key is compared: PREFIX_MATCH allows everything beneath the path. An empty map means no artifact of this type may load on shared-access compute.","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the allowlist belongs to","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog artifact allowlist","desc":"The set of artifacts a metastore permits on compute running in a shared access mode, keyed by artifact type. Shared-access clusters refuse init scripts and libraries that are not allowlisted, which is what keeps one user's code from running in another user's session, so an empty allowlist for a type means nothing of that type may load. Select an allowlist by type, for example `databricks.artifactAllowlists.where(artifactType == \"INIT_SCRIPT\")`.","min_provider_version":"13.1.4","defaults":"artifactType","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.catalog":{"id":"databricks.catalog","name":"databricks.catalog","fields":{"catalogType":{"name":"catalogType","type":"\u0007","is_mandatory":true,"title":"Catalog type","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Catalog comment","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the catalog","provider":"go.mondoo.com/mql/providers/databricks"},"isolationMode":{"name":"isolationMode","type":"\u0007","is_mandatory":true,"title":"Isolation mode (ISOLATED or OPEN)","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the catalog belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Catalog name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the catalog","provider":"go.mondoo.com/mql/providers/databricks"},"schemas":{"name":"schemas","type":"\u0019\u001bdatabricks.schema","title":"Schemas contained in the catalog","provider":"go.mondoo.com/mql/providers/databricks"},"workspaceBindings":{"name":"workspaceBindings","type":"\u001a\u0007\u0007","title":"Workspaces the catalog is bound to","desc":"Keyed by numeric workspace id, valued by the access the binding grants: BINDING_TYPE_READ_WRITE or BINDING_TYPE_READ_ONLY. Only meaningful when isolationMode is ISOLATED, which restricts the catalog to the bound workspaces. An OPEN catalog is reachable from every workspace attached to the metastore no matter what this map contains.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog catalog","desc":"A Unity Catalog catalog accessible from the workspace, keyed by name. Covers the owner, the metastore it belongs to, the isolation mode that controls which workspaces can bind it, the schemas it contains, and the privilege grants assigned on it. Select a catalog by name, for example `databricks.catalogs.where(name == \"main\")`.","min_provider_version":"13.0.0","defaults":"name owner isolationMode","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.cluster":{"id":"databricks.cluster","name":"databricks.cluster","fields":{"autoterminationMinutes":{"name":"autoterminationMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes of inactivity before the cluster auto-terminates, 0 when disabled","provider":"go.mondoo.com/mql/providers/databricks"},"clusterName":{"name":"clusterName","type":"\u0007","is_mandatory":true,"title":"Cluster name","provider":"go.mondoo.com/mql/providers/databricks"},"creatorUserName":{"name":"creatorUserName","type":"\u0007","is_mandatory":true,"title":"Login name of the user that created the cluster","provider":"go.mondoo.com/mql/providers/databricks"},"customTags":{"name":"customTags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom tags applied to the cluster","provider":"go.mondoo.com/mql/providers/databricks"},"dataSecurityMode":{"name":"dataSecurityMode","type":"\u0007","is_mandatory":true,"title":"Data security mode","desc":"Governs Unity Catalog isolation. Values include SINGLE_USER, USER_ISOLATION, DATA_SECURITY_MODE_DEDICATED, DATA_SECURITY_MODE_STANDARD, DATA_SECURITY_MODE_AUTO, NONE, and the LEGACY_* modes (LEGACY_PASSTHROUGH, LEGACY_SINGLE_USER, LEGACY_SINGLE_USER_STANDARD, LEGACY_TABLE_ACL).","provider":"go.mondoo.com/mql/providers/databricks"},"dependencyMode":{"name":"dependencyMode","type":"\u0007","is_mandatory":true,"title":"Dependency configuration mode","desc":"One of DEPENDENCY_MODE_AUTO, DEPENDENCY_MODE_ENVIRONMENTS, or DEPENDENCY_MODE_CLUSTER_LIBRARIES. The cluster libraries mode is the legacy behavior, in which dependencies come from cluster libraries and init scripts rather than a declared environment.","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/databricks"},"dockerImageUrl":{"name":"dockerImageUrl","type":"\u0007","is_mandatory":true,"title":"URL of the custom Docker image the cluster nodes boot from","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/databricks"},"googleServiceAccount":{"name":"googleServiceAccount","type":"\u0007","is_mandatory":true,"title":"Google service account the cluster impersonates when reaching Google Cloud services","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Cluster id","provider":"go.mondoo.com/mql/providers/databricks"},"initScripts":{"name":"initScripts","type":"\u0019\n","is_mandatory":true,"title":"Init scripts run on every node at cluster startup","desc":"Scripts executed on each node as the cluster starts, in the order configured. Each entry carries a `type` naming the storage backing the script (`workspace`, `volumes`, `s3`, `abfss`, `gcs`, `dbfs`, or `file`) and a `destination` path. Entries of type `s3` additionally carry `region`, `endpoint`, and `enableEncryption`. Init scripts execute with cluster privileges before any workload runs, so a destination that is writable outside the workspace is worth review.","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/databricks"},"instancePool":{"name":"instancePool","type":"\u001bdatabricks.instancePool","title":"Instance pool the cluster draws its nodes from","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"instanceProfile":{"name":"instanceProfile","type":"\u001bdatabricks.instanceProfile","title":"AWS instance profile the cluster nodes assume","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/databricks"},"localDiskEncryptionEnabled":{"name":"localDiskEncryptionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether local disk encryption is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"permissions":{"name":"permissions","type":"\u0019\u001bdatabricks.permission","title":"Workspace access control list of the cluster","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"policy":{"name":"policy","type":"\u001bdatabricks.clusterPolicy","title":"Policy the cluster was created against","provider":"go.mondoo.com/mql/providers/databricks"},"policyCompliant":{"name":"policyCompliant","type":"\u0004","title":"Whether the cluster's current settings satisfy the policy it was created against","desc":"Null when no policy is attached, since there is nothing to comply with. A cluster can drift out of compliance after the policy is tightened, so this reports the live comparison rather than the state at creation. Pair it with a policy check, as `policy != null \u0026\u0026 policyCompliant`, because a null on an unpoliced cluster would otherwise read as a pass.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"policyViolations":{"name":"policyViolations","type":"\u001a\u0007\u0007","title":"Settings that violate the attached policy, keyed by setting path","desc":"Each key names a cluster setting the policy rejects, such as `spark_version` or `num_workers`, and its value describes the violation. Empty on a compliant cluster and null when no policy is attached.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"runtimeEngine":{"name":"runtimeEngine","type":"\u0007","is_mandatory":true,"title":"Runtime engine (NULL, PHOTON, or STANDARD)","provider":"go.mondoo.com/mql/providers/databricks"},"singleUserName":{"name":"singleUserName","type":"\u0007","is_mandatory":true,"title":"User a single-user cluster runs as","provider":"go.mondoo.com/mql/providers/databricks"},"sparkConf":{"name":"sparkConf","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Spark configuration key/value pairs","provider":"go.mondoo.com/mql/providers/databricks"},"sparkEnvVars":{"name":"sparkEnvVars","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Spark environment variables","provider":"go.mondoo.com/mql/providers/databricks"},"sparkVersion":{"name":"sparkVersion","type":"\u0007","is_mandatory":true,"title":"Databricks Runtime version","provider":"go.mondoo.com/mql/providers/databricks"},"sshPublicKeys":{"name":"sshPublicKeys","type":"\u0019\u0007","is_mandatory":true,"title":"SSH public keys authorized for direct access to the cluster nodes","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/databricks"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current state (such as RUNNING or TERMINATED)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks compute cluster","desc":"A compute cluster in the workspace, keyed by its cluster id. Covers the data security mode that governs Unity Catalog isolation, the Spark runtime and configuration, local disk encryption, the auto-termination window, and the policy the cluster was created against. Select a cluster by id, for example `databricks.clusters.where(clusterName == \"shared\")`.","min_provider_version":"13.0.0","defaults":"clusterName dataSecurityMode state","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.clusterPolicy":{"id":"databricks.clusterPolicy","name":"databricks.clusterPolicy","fields":{"creatorUserName":{"name":"creatorUserName","type":"\u0007","is_mandatory":true,"title":"Login name of the user that created the policy","provider":"go.mondoo.com/mql/providers/databricks"},"definition":{"name":"definition","type":"\u0007","is_mandatory":true,"title":"JSON document defining the policy rules","provider":"go.mondoo.com/mql/providers/databricks"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy id","provider":"go.mondoo.com/mql/providers/databricks"},"isDefault":{"name":"isDefault","type":"\u0004","is_mandatory":true,"title":"Whether the policy is the workspace default","provider":"go.mondoo.com/mql/providers/databricks"},"maxClustersPerUser":{"name":"maxClustersPerUser","type":"\u0005","is_mandatory":true,"title":"Maximum number of clusters a single user may create with the policy","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/mql/providers/databricks"},"permissions":{"name":"permissions","type":"\u0019\u001bdatabricks.permission","title":"Workspace access control list of the cluster policy","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks cluster policy","desc":"A cluster policy in the workspace that constrains the attributes of clusters created against it, keyed by name. Covers the JSON policy document, the per-user cluster cap, and whether the policy is the workspace default. Select a policy by name, for example `databricks.clusterPolicies.where(name == \"job-only\")`.","min_provider_version":"13.0.0","defaults":"name maxClustersPerUser","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.clusterSpec":{"id":"databricks.clusterSpec","name":"databricks.clusterSpec","fields":{"customTags":{"name":"customTags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom tags applied to the compute and its cloud resources","provider":"go.mondoo.com/mql/providers/databricks"},"dataSecurityMode":{"name":"dataSecurityMode","type":"\u0007","is_mandatory":true,"title":"Access mode governing which identities and data the compute can reach","desc":"Values include SINGLE_USER, USER_ISOLATION, LEGACY_TABLE_ACL, LEGACY_PASSTHROUGH, LEGACY_SINGLE_USER, LEGACY_SINGLE_USER_STANDARD, DATA_SECURITY_MODE_AUTO, DATA_SECURITY_MODE_DEDICATED, DATA_SECURITY_MODE_STANDARD, and NONE, which disables Unity Catalog access. Empty when the compute does not set one.","provider":"go.mondoo.com/mql/providers/databricks"},"dockerImageUrl":{"name":"dockerImageUrl","type":"\u0007","is_mandatory":true,"title":"Custom container image the compute boots, empty for a stock runtime","provider":"go.mondoo.com/mql/providers/databricks"},"googleServiceAccount":{"name":"googleServiceAccount","type":"\u0007","is_mandatory":true,"title":"GCP service account the compute impersonates, empty off GCP","provider":"go.mondoo.com/mql/providers/databricks"},"initScripts":{"name":"initScripts","type":"\u0019\n","is_mandatory":true,"title":"Init scripts run on every node at startup","desc":"One entry per script in configured order, each with a type of workspace, volumes, s3, abfss, gcs, dbfs, or file, and the destination path. S3 entries also carry region, endpoint, and enableEncryption.","provider":"go.mondoo.com/mql/providers/databricks"},"instanceProfile":{"name":"instanceProfile","type":"\u001bdatabricks.instanceProfile","title":"AWS instance profile the compute assumes","provider":"go.mondoo.com/mql/providers/databricks"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Key the specification is registered under","desc":"The job cluster key for a job cluster or the label for a pipeline cluster, empty for compute declared inline on a single task.","provider":"go.mondoo.com/mql/providers/databricks"},"localDiskEncryptionEnabled":{"name":"localDiskEncryptionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether local disks are encrypted at rest","provider":"go.mondoo.com/mql/providers/databricks"},"nodeTypeId":{"name":"nodeTypeId","type":"\u0007","is_mandatory":true,"title":"Instance type of the worker nodes","provider":"go.mondoo.com/mql/providers/databricks"},"numWorkers":{"name":"numWorkers","type":"\u0005","is_mandatory":true,"title":"Fixed worker count, 0 when the compute autoscales or runs single-node","provider":"go.mondoo.com/mql/providers/databricks"},"policy":{"name":"policy","type":"\u001bdatabricks.clusterPolicy","title":"Cluster policy constraining the compute","provider":"go.mondoo.com/mql/providers/databricks"},"runtimeEngine":{"name":"runtimeEngine","type":"\u0007","is_mandatory":true,"title":"Execution engine, PHOTON or STANDARD","provider":"go.mondoo.com/mql/providers/databricks"},"singleUserName":{"name":"singleUserName","type":"\u0007","is_mandatory":true,"title":"Identity a single-user compute runs as, empty on other access modes","provider":"go.mondoo.com/mql/providers/databricks"},"sparkConf":{"name":"sparkConf","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Spark configuration entries set on the compute","provider":"go.mondoo.com/mql/providers/databricks"},"sparkEnvVars":{"name":"sparkEnvVars","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Environment variables set on the compute","provider":"go.mondoo.com/mql/providers/databricks"},"sparkVersion":{"name":"sparkVersion","type":"\u0007","is_mandatory":true,"title":"Databricks Runtime version the compute boots","provider":"go.mondoo.com/mql/providers/databricks"},"sshPublicKeys":{"name":"sshPublicKeys","type":"\u0019\u0007","is_mandatory":true,"title":"SSH public keys authorized on the compute nodes","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Compute specification of a job or pipeline","desc":"The cluster definition a job task or pipeline creates for each run, as opposed to a long-lived cluster in databricks.cluster. Covers the access mode that decides whether the compute can reach Unity Catalog data, the Spark configuration and environment variables that may carry secrets, the init scripts and container image the compute boots, the cloud identity it assumes, and the cluster policy constraining it.","private":true,"min_provider_version":"13.1.4","defaults":"key dataSecurityMode sparkVersion","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.connection":{"id":"databricks.connection","name":"databricks.connection","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Connection comment","provider":"go.mondoo.com/mql/providers/databricks"},"connectionType":{"name":"connectionType","type":"\u0007","is_mandatory":true,"title":"External system the connection reaches","desc":"One of BIGQUERY, CONFLUENCE, DATABRICKS, DYNAMICS365, GA4_RAW_DATA, GITHUB, GLUE, HIVE_METASTORE, HTTP, HUBSPOT, JDBC, META_MARKETING, MYSQL, NETSUITE, ORACLE, OUTLOOK, POSTGRESQL, POWER_BI, REDSHIFT, SALESFORCE, SALESFORCE_DATA_CLOUD, SERVICENOW, SMARTSHEET, SNOWFLAKE, SQLDW, SQLSERVER, TERADATA, WORKDAY_RAAS, ZENDESK, or UNKNOWN_CONNECTION_TYPE.","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the connection was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the connection","provider":"go.mondoo.com/mql/providers/databricks"},"credentialType":{"name":"credentialType","type":"\u0007","is_mandatory":true,"title":"Kind of credential the connection authenticates with","desc":"One of ANY_STATIC_CREDENTIAL, BEARER_TOKEN, EDGEGRID_AKAMAI, OAUTH_ACCESS_TOKEN, OAUTH_M2M, OAUTH_MTLS, OAUTH_REFRESH_TOKEN, OAUTH_RESOURCE_OWNER_PASSWORD, OAUTH_U2M, OAUTH_U2M_MAPPING, OIDC_TOKEN, PEM_PRIVATE_KEY, SERVICE_CREDENTIAL, SSWS_TOKEN, USERNAME_PASSWORD, or UNKNOWN_CREDENTIAL_TYPE.","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the connection","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the connection","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the connection","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the connection belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name","provider":"go.mondoo.com/mql/providers/databricks"},"options":{"name":"options","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Non-secret connection parameters","desc":"The host, port, database, account, and similar parameters that locate the external system. Keys naming credential material (passwords, tokens, secrets, private keys) are removed, so this map describes where the connection goes but never how it authenticates.","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the connection","provider":"go.mondoo.com/mql/providers/databricks"},"properties":{"name":"properties","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Free-form properties recorded on the connection","provider":"go.mondoo.com/mql/providers/databricks"},"provisioningState":{"name":"provisioningState","type":"\u0007","is_mandatory":true,"title":"Provisioning state of the connection, such as STATE_UNSPECIFIED, PROVISIONING, ACTIVE, FAILED, or DELETING","provider":"go.mondoo.com/mql/providers/databricks"},"readOnly":{"name":"readOnly","type":"\u0004","is_mandatory":true,"title":"Whether the connection is usable only for read operations","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the connection was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the connection","provider":"go.mondoo.com/mql/providers/databricks"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"URL of the external system, when the connection type carries one","provider":"go.mondoo.com/mql/providers/databricks"},"workspaceBindings":{"name":"workspaceBindings","type":"\u001a\u0007\u0007","title":"Workspaces the connection is bound to","desc":"Keyed by numeric workspace id, valued by the access the binding grants. Connections only support BINDING_TYPE_READ_WRITE. A connection with no bindings is reachable from every workspace attached to the metastore.","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog connection","desc":"A connection registers an external data system that Unity Catalog queries through, keyed by name. Connections are the outbound edge of the workspace: a foreign catalog reading from Snowflake, Redshift, PostgreSQL, or BigQuery, or an HTTP connection reaching an arbitrary endpoint. Auditing connections surfaces the system type, the destination URL and connection options, the kind of credential the connection authenticates with, the owner, whether the connection is read-only, the privilege grants assigned on it, and the workspaces it is bound to. Select a connection by name, for example `databricks.connections.where(name == \"snowflake-prod\")`.","min_provider_version":"13.1.4","defaults":"name connectionType credentialType owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.credential":{"id":"databricks.credential","name":"databricks.credential","fields":{"awsIamRoleArn":{"name":"awsIamRoleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the AWS IAM role the credential assumes","provider":"go.mondoo.com/mql/providers/databricks"},"awsIamRoleExternalId":{"name":"awsIamRoleExternalId","type":"\u0007","is_mandatory":true,"title":"External ID used when assuming the AWS IAM role, which guards against the confused-deputy problem","provider":"go.mondoo.com/mql/providers/databricks"},"awsIamRoleUnityCatalogIamArn":{"name":"awsIamRoleUnityCatalogIamArn","type":"\u0007","is_mandatory":true,"title":"ARN of the Databricks-side role that assumes the customer AWS IAM role","provider":"go.mondoo.com/mql/providers/databricks"},"azureAccessConnectorId":{"name":"azureAccessConnectorId","type":"\u0007","is_mandatory":true,"title":"Azure resource ID of the Databricks access connector for the managed identity","provider":"go.mondoo.com/mql/providers/databricks"},"azureManagedIdentityId":{"name":"azureManagedIdentityId","type":"\u0007","is_mandatory":true,"title":"Azure resource ID of the user-assigned managed identity, empty when the access connector's system-assigned identity is used","provider":"go.mondoo.com/mql/providers/databricks"},"azureServicePrincipalApplicationId":{"name":"azureServicePrincipalApplicationId","type":"\u0007","is_mandatory":true,"title":"Application ID of the Azure service principal the credential uses","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Credential comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the credential was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the credential","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the credential","provider":"go.mondoo.com/mql/providers/databricks"},"gcpServiceAccountEmail":{"name":"gcpServiceAccountEmail","type":"\u0007","is_mandatory":true,"title":"Email of the GCP service account the credential uses","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the credential","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the credential","provider":"go.mondoo.com/mql/providers/databricks"},"isolationMode":{"name":"isolationMode","type":"\u0007","is_mandatory":true,"title":"Isolation mode (ISOLATED or OPEN)","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the credential belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Credential name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the credential","provider":"go.mondoo.com/mql/providers/databricks"},"purpose":{"name":"purpose","type":"\u0007","is_mandatory":true,"title":"What the credential is used to reach","desc":"One of STORAGE for cloud object storage or SERVICE for other cloud services such as AWS Lambda or Azure Functions.","provider":"go.mondoo.com/mql/providers/databricks"},"readOnly":{"name":"readOnly","type":"\u0004","is_mandatory":true,"title":"Whether the credential is usable only for read operations","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the credential was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the credential","provider":"go.mondoo.com/mql/providers/databricks"},"usedForManagedStorage":{"name":"usedForManagedStorage","type":"\u0004","is_mandatory":true,"title":"Whether the credential backs the metastore's root managed storage","provider":"go.mondoo.com/mql/providers/databricks"},"workspaceBindings":{"name":"workspaceBindings","type":"\u001a\u0007\u0007","title":"Workspaces the credential is bound to","desc":"Keyed by numeric workspace id, valued by the access the binding grants. Credentials only support BINDING_TYPE_READ_WRITE. Only meaningful when isolationMode is ISOLATED, which restricts the credential to the bound workspaces.","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog credential","desc":"A credential holds the cloud identity Unity Catalog assumes to reach a resource outside Databricks, keyed by name. The purpose field separates the two kinds: STORAGE credentials reach cloud object storage and are the same objects surfaced by storageCredentials, while SERVICE credentials reach other cloud services and are only available here. Auditing credentials surfaces the vended principal (the AWS IAM role ARN and its external ID, the Azure access connector and managed identity, the Azure application ID, or the GCP service account email), the isolation mode and the workspaces bound under it, whether the credential is read-only or backs the metastore's root managed storage, and the privilege grants assigned on it. Select a credential by name, for example `databricks.credentials.where(name == \"prod-lambda\")`.","min_provider_version":"13.1.4","defaults":"name purpose owner isolationMode","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.credentialConfiguration":{"id":"databricks.credentialConfiguration","name":"databricks.credentialConfiguration","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the configuration was created","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Configuration id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Configuration name","provider":"go.mondoo.com/mql/providers/databricks"},"roleArn":{"name":"roleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the cross-account IAM role Databricks assumes","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Account credential configuration","desc":"A cross-account role the Databricks control plane assumes to manage resources in the customer's cloud account, keyed by its configuration id. This is the standing grant that lets Databricks create compute and reach storage on the account's behalf. Select a configuration by name, for example `databricks.credentialConfigurations.where(name == \"prod-role\")`.","min_provider_version":"13.1.4","defaults":"name roleArn","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.customerManagedKey":{"id":"databricks.customerManagedKey","name":"databricks.customerManagedKey","fields":{"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"When the key configuration was created","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Encryption key configuration id","provider":"go.mondoo.com/mql/providers/databricks"},"keyAlias":{"name":"keyAlias","type":"\u0007","is_mandatory":true,"title":"Alias of the AWS KMS key, empty for non-AWS keys","provider":"go.mondoo.com/mql/providers/databricks"},"keyArn":{"name":"keyArn","type":"\u0007","is_mandatory":true,"title":"ARN of the AWS KMS key, empty for non-AWS keys","provider":"go.mondoo.com/mql/providers/databricks"},"keyRegion":{"name":"keyRegion","type":"\u0007","is_mandatory":true,"title":"Region of the AWS KMS key, empty for non-AWS keys","provider":"go.mondoo.com/mql/providers/databricks"},"kmsKeyId":{"name":"kmsKeyId","type":"\u0007","is_mandatory":true,"title":"Resource id of the GCP KMS key, empty for non-GCP keys","provider":"go.mondoo.com/mql/providers/databricks"},"useCases":{"name":"useCases","type":"\u0019\u0007","is_mandatory":true,"title":"Use cases the key applies to","desc":"Each entry is MANAGED_SERVICES (control-plane notebooks, secrets, and query history) or STORAGE (the workspace root bucket and, optionally, cluster EBS volumes).","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Customer-managed encryption key","desc":"An encryption key registered in the account for protecting workspace managed services or storage, keyed by its configuration id. Covers the use cases the key applies to (MANAGED_SERVICES for control-plane notebooks, secrets, and query history, STORAGE for the workspace root bucket and, optionally, cluster EBS volumes), the creation time, and the cloud key identifiers (the AWS KMS key ARN, alias, and region, or the GCP KMS key resource id). Select a key by id, for example `databricks.customerManagedKeys.where(id == \"...\")`.","min_provider_version":"13.0.1","defaults":"id useCases creationTime","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.deltaSharingRecipient":{"id":"databricks.deltaSharingRecipient","name":"databricks.deltaSharingRecipient","fields":{"activated":{"name":"activated","type":"\u0004","is_mandatory":true,"title":"Whether the recipient's activation URL has been exercised","provider":"go.mondoo.com/mql/providers/databricks"},"authenticationType":{"name":"authenticationType","type":"\u0007","is_mandatory":true,"title":"Authentication type","desc":"One of TOKEN (open sharing secured by a bearer token), DATABRICKS (Databricks-to-Databricks sharing between metastores), OAUTH_CLIENT_CREDENTIALS, or OIDC_FEDERATION.","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Recipient comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the recipient was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the recipient","provider":"go.mondoo.com/mql/providers/databricks"},"dataRecipientGlobalMetastoreId":{"name":"dataRecipientGlobalMetastoreId","type":"\u0007","is_mandatory":true,"title":"Global metastore id of the data recipient, present for DATABRICKS authentication","provider":"go.mondoo.com/mql/providers/databricks"},"ipAccessList":{"name":"ipAccessList","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed IP addresses in CIDR notation the recipient may connect from","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Recipient name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the recipient","provider":"go.mondoo.com/mql/providers/databricks"},"tokens":{"name":"tokens","type":"\u0019\n","is_mandatory":true,"title":"Non-secret metadata for each issued token","desc":"One entry per token with its id, expirationTime, and createdAt. Token secret values and activation URLs are deliberately excluded.","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the recipient was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the recipient","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Delta Sharing recipient","desc":"A recipient that workspace data is shared with through Delta Sharing, keyed by name. Covers the authentication type (TOKEN for open sharing secured by a bearer token, DATABRICKS for Databricks-to-Databricks sharing between metastores), whether the recipient has been activated, the owner and comment, the data recipient's global metastore id for Databricks-to-Databricks sharing, the IP access list restricting where the recipient may connect from, and non-secret metadata for each issued token. Token secret values and activation URLs are never exposed. Select a recipient by name, for example `databricks.deltaSharingRecipients.where(name == \"partner\")`.","min_provider_version":"13.0.1","defaults":"name authenticationType activated","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.deltaSharingShare":{"id":"databricks.deltaSharingShare","name":"databricks.deltaSharingShare","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Share comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the share was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the share","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Share name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the share","provider":"go.mondoo.com/mql/providers/databricks"},"sharedObjects":{"name":"sharedObjects","type":"\u0019\n","is_mandatory":true,"title":"Data objects included in the share","desc":"One entry per shared object with its name, dataObjectType, sharedAs, cdfEnabled, comment, addedAt, and addedBy.","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the share was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the share","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Delta Sharing share","desc":"A share, a named collection of data objects made available to Delta Sharing recipients, keyed by name. Covers the owner, comment, the data objects included in the share, and creation and modification metadata. Select a share by name, for example `databricks.deltaSharingShares.where(name == \"sales\")`.","min_provider_version":"13.0.1","defaults":"name owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.externalLocation":{"id":"databricks.externalLocation","name":"databricks.externalLocation","fields":{"browseOnly":{"name":"browseOnly","type":"\u0004","is_mandatory":true,"title":"Whether the principal is limited to browsing metadata through the BROWSE privilege","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Location comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the location was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the location","provider":"go.mondoo.com/mql/providers/databricks"},"credential":{"name":"credential","type":"\u001bdatabricks.storageCredential","title":"Storage credential used to reach this location","provider":"go.mondoo.com/mql/providers/databricks"},"fallback":{"name":"fallback","type":"\u0004","is_mandatory":true,"title":"Whether access falls back to cluster credentials when Unity Catalog credentials are insufficient","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the location","provider":"go.mondoo.com/mql/providers/databricks"},"isolationMode":{"name":"isolationMode","type":"\u0007","is_mandatory":true,"title":"Isolation mode (ISOLATED or OPEN)","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the location belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Location name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the location","provider":"go.mondoo.com/mql/providers/databricks"},"readOnly":{"name":"readOnly","type":"\u0004","is_mandatory":true,"title":"Whether the location is read-only","provider":"go.mondoo.com/mql/providers/databricks"},"sseEncryptionAlgorithm":{"name":"sseEncryptionAlgorithm","type":"\u0007","is_mandatory":true,"title":"Server-side encryption algorithm applied to the storage path","desc":"One of AWS_SSE_S3 or AWS_SSE_KMS. Empty when no server-side encryption is recorded for the location.","provider":"go.mondoo.com/mql/providers/databricks"},"sseKmsKeyArn":{"name":"sseKmsKeyArn","type":"\u0007","is_mandatory":true,"title":"ARN of the KMS key used for server-side encryption, when the algorithm is AWS_SSE_KMS","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the location was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the location","provider":"go.mondoo.com/mql/providers/databricks"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Storage path URL the location points at","provider":"go.mondoo.com/mql/providers/databricks"},"workspaceBindings":{"name":"workspaceBindings","type":"\u001a\u0007\u0007","title":"Workspaces the location is bound to","desc":"Keyed by numeric workspace id, valued by the access the binding grants. External locations only support BINDING_TYPE_READ_WRITE. Only meaningful when isolationMode is ISOLATED, which restricts the location to the bound workspaces.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog external location","desc":"An external location maps a cloud storage path to a storage credential and bounds the reach of Unity Catalog access to that path. Auditing external locations surfaces the storage URL, the credential used to reach it, the isolation mode that controls which workspaces can bind it, whether it is read-only, whether fallback to cluster credentials is allowed, the server-side encryption applied to the path, and the privilege grants assigned on it. Select a location by name, for example `databricks.externalLocations.where(name == \"prod-landing\")`.","min_provider_version":"13.0.1","defaults":"name url owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.federationPolicy":{"id":"databricks.federationPolicy","name":"databricks.federationPolicy","fields":{"createTime":{"name":"createTime","type":"\t","is_mandatory":true,"title":"When the policy was created","provider":"go.mondoo.com/mql/providers/databricks"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Policy description","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/mql/providers/databricks"},"oidcAudiences":{"name":"oidcAudiences","type":"\u0019\u0007","is_mandatory":true,"title":"Token audiences the policy accepts","desc":"A token is only accepted when its audience matches one of these. An empty list means the default audience applies.","provider":"go.mondoo.com/mql/providers/databricks"},"oidcIssuer":{"name":"oidcIssuer","type":"\u0007","is_mandatory":true,"title":"Issuer URL of the identity provider the policy trusts","provider":"go.mondoo.com/mql/providers/databricks"},"oidcJwksUri":{"name":"oidcJwksUri","type":"\u0007","is_mandatory":true,"title":"URL the issuer's signing keys are fetched from","provider":"go.mondoo.com/mql/providers/databricks"},"oidcSubject":{"name":"oidcSubject","type":"\u0007","is_mandatory":true,"title":"Subject the policy binds to, identifying the external workload","provider":"go.mondoo.com/mql/providers/databricks"},"oidcSubjectClaim":{"name":"oidcSubjectClaim","type":"\u0007","is_mandatory":true,"title":"Token claim the subject is read from, defaulting to sub","provider":"go.mondoo.com/mql/providers/databricks"},"servicePrincipalId":{"name":"servicePrincipalId","type":"\u0005","is_mandatory":true,"title":"Service principal the policy authenticates as, 0 for an account-level policy","provider":"go.mondoo.com/mql/providers/databricks"},"uid":{"name":"uid","type":"\u0007","is_mandatory":true,"title":"Unique identifier assigned to the policy","provider":"go.mondoo.com/mql/providers/databricks"},"updateTime":{"name":"updateTime","type":"\t","is_mandatory":true,"title":"When the policy was last modified","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"OIDC federation policy","desc":"A policy that lets a workload outside Databricks exchange an OIDC token for Databricks access without a stored secret, keyed by its policy id. The policy names the issuer it trusts, the audiences it accepts, and the subject it binds to, so it defines exactly which external identity can authenticate. An account policy applies to the whole account; a policy attached to a service principal authenticates as that principal. A policy with a broad subject claim admits more external workloads than intended. Select a policy by name, for example `databricks.federationPolicies.where(name == \"github-actions\")`.","min_provider_version":"13.1.4","defaults":"name oidcIssuer oidcSubject","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.gitCredential":{"id":"databricks.gitCredential","name":"databricks.gitCredential","fields":{"gitEmail":{"name":"gitEmail","type":"\u0007","is_mandatory":true,"title":"Email address recorded on commits made with the credential","provider":"go.mondoo.com/mql/providers/databricks"},"gitProvider":{"name":"gitProvider","type":"\u0007","is_mandatory":true,"title":"Git hosting provider the credential authenticates to, such as gitHub, gitLab, or bitbucketCloud","provider":"go.mondoo.com/mql/providers/databricks"},"gitUsername":{"name":"gitUsername","type":"\u0007","is_mandatory":true,"title":"Account name the credential authenticates as","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric identifier of the credential","provider":"go.mondoo.com/mql/providers/databricks"},"isDefaultForProvider":{"name":"isDefaultForProvider","type":"\u0004","is_mandatory":true,"title":"Whether the credential is used by default for its provider","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Credential name, empty when none is set","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Git provider credential","desc":"A credential the workspace stores to authenticate against a Git hosting provider, keyed by its numeric id. These credentials let jobs and Git folders reach private repositories, so auditing them surfaces which providers the workspace can authenticate to and under which account. The token itself is write-only in the API and is never returned. Select a credential by provider, for example `databricks.gitCredentials.where(gitProvider == \"gitHub\")`.","min_provider_version":"13.1.4","defaults":"gitProvider gitUsername","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.globalInitScript":{"id":"databricks.globalInitScript","name":"databricks.globalInitScript","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the script was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the script","provider":"go.mondoo.com/mql/providers/databricks"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the script is enabled and runs on cluster startup","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Script id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Script name","provider":"go.mondoo.com/mql/providers/databricks"},"position":{"name":"position","type":"\u0005","is_mandatory":true,"title":"Run-order position, where 0 is the first script to run","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the script was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the script","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Global init script","desc":"A script that runs on every cluster in the workspace during startup, keyed by its script id. Because it executes on all clusters, an enabled global init script is a persistence and code-execution vector worth auditing. Covers the name, whether it is enabled, its run-order position, and creation and modification metadata. Select a script by id, for example `databricks.globalInitScripts.where(name == \"bootstrap\")`.","min_provider_version":"13.0.1","defaults":"name enabled position","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.grant":{"id":"databricks.grant","name":"databricks.grant","fields":{"principal":{"name":"principal","type":"\u0007","is_mandatory":true,"title":"Principal (user, group, or service principal) the privileges are granted to","provider":"go.mondoo.com/mql/providers/databricks"},"privileges":{"name":"privileges","type":"\u0019\u0007","is_mandatory":true,"title":"Privileges granted to the principal on the securable","provider":"go.mondoo.com/mql/providers/databricks"},"securableName":{"name":"securableName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the securable","provider":"go.mondoo.com/mql/providers/databricks"},"securableType":{"name":"securableType","type":"\u0007","is_mandatory":true,"title":"Type of securable the grant applies to (such as CATALOG or SCHEMA)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog privilege grant","desc":"A set of privileges granted to a single principal on a Unity Catalog securable (a catalog or schema). Covers the principal, the granted privileges (such as SELECT, MODIFY, ALL_PRIVILEGES, or USE_SCHEMA), and the securable the grant applies to.","min_provider_version":"13.0.0","defaults":"principal securableType securableName","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.group":{"id":"databricks.group","name":"databricks.group","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Group name","provider":"go.mondoo.com/mql/providers/databricks"},"entitlements":{"name":"entitlements","type":"\u0019\u0007","is_mandatory":true,"title":"Entitlements granted to the group","provider":"go.mondoo.com/mql/providers/databricks"},"externalId":{"name":"externalId","type":"\u0007","is_mandatory":true,"title":"External identity provider id","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SCIM id","provider":"go.mondoo.com/mql/providers/databricks"},"members":{"name":"members","type":"\u0019\u0007","is_mandatory":true,"title":"Ids of the group's members","provider":"go.mondoo.com/mql/providers/databricks"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Cloud roles granted to the group","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks account group","desc":"A group provisioned in the Databricks account through SCIM, keyed by displayName. Covers the members (users, service principals, and nested groups), the account-level entitlements granted to the group, and cloud roles. Select a group by name, for example `databricks.groups.where(displayName == \"admins\")`.","min_provider_version":"13.0.0","defaults":"displayName","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.instancePool":{"id":"databricks.instancePool","name":"databricks.instancePool","fields":{"awsAvailability":{"name":"awsAvailability","type":"\u0007","is_mandatory":true,"title":"Purchasing model for AWS instances, ON_DEMAND or SPOT","provider":"go.mondoo.com/mql/providers/databricks"},"awsSpotBidPricePercent":{"name":"awsSpotBidPricePercent","type":"\u0005","is_mandatory":true,"title":"Bid price for AWS spot instances, as a percentage of the on-demand price","provider":"go.mondoo.com/mql/providers/databricks"},"awsZoneId":{"name":"awsZoneId","type":"\u0007","is_mandatory":true,"title":"AWS availability zone the pool provisions into","provider":"go.mondoo.com/mql/providers/databricks"},"azureAvailability":{"name":"azureAvailability","type":"\u0007","is_mandatory":true,"title":"Purchasing model for Azure instances, ON_DEMAND_AZURE or SPOT_AZURE","provider":"go.mondoo.com/mql/providers/databricks"},"azureSpotBidMaxPrice":{"name":"azureSpotBidMaxPrice","type":"\u0006","is_mandatory":true,"title":"Maximum bid price for Azure spot instances, -1 when bidding at the on-demand price","provider":"go.mondoo.com/mql/providers/databricks"},"customTags":{"name":"customTags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom tags applied to every instance in the pool","provider":"go.mondoo.com/mql/providers/databricks"},"defaultTags":{"name":"defaultTags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags Databricks applies to every instance in the pool","provider":"go.mondoo.com/mql/providers/databricks"},"diskCount":{"name":"diskCount","type":"\u0005","is_mandatory":true,"title":"Number of managed disks attached to each instance","provider":"go.mondoo.com/mql/providers/databricks"},"diskSize":{"name":"diskSize","type":"\u0005","is_mandatory":true,"title":"Size of each attached disk in GB","provider":"go.mondoo.com/mql/providers/databricks"},"diskType":{"name":"diskType","type":"\u0007","is_mandatory":true,"title":"Type of the attached disks","desc":"GENERAL_PURPOSE_SSD or THROUGHPUT_OPTIMIZED_HDD on AWS, or the Azure disk volume type. Empty when the pool attaches no managed disks.","provider":"go.mondoo.com/mql/providers/databricks"},"enableElasticDisk":{"name":"enableElasticDisk","type":"\u0004","is_mandatory":true,"title":"Whether managed disks are added automatically as local storage fills","provider":"go.mondoo.com/mql/providers/databricks"},"gcpAvailability":{"name":"gcpAvailability","type":"\u0007","is_mandatory":true,"title":"Purchasing model for GCP instances, ON_DEMAND_GCP, PREEMPTIBLE_GCP, or PREEMPTIBLE_WITH_FALLBACK_GCP","provider":"go.mondoo.com/mql/providers/databricks"},"gcpLocalSsdCount":{"name":"gcpLocalSsdCount","type":"\u0005","is_mandatory":true,"title":"Local SSDs attached to each GCP instance","provider":"go.mondoo.com/mql/providers/databricks"},"gcpZoneId":{"name":"gcpZoneId","type":"\u0007","is_mandatory":true,"title":"GCP availability zone the pool provisions into","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Pool id","provider":"go.mondoo.com/mql/providers/databricks"},"idleInstanceAutoterminationMinutes":{"name":"idleInstanceAutoterminationMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes an idle instance is kept before being released, 0 when kept indefinitely","provider":"go.mondoo.com/mql/providers/databricks"},"instanceProfile":{"name":"instanceProfile","type":"\u001bdatabricks.instanceProfile","title":"AWS instance profile the pool's nodes assume","desc":"Every cluster attaching to the pool inherits this identity, so it grants cloud access that no individual cluster definition records.","provider":"go.mondoo.com/mql/providers/databricks"},"maxCapacity":{"name":"maxCapacity","type":"\u0005","is_mandatory":true,"title":"Upper bound on instances the pool may hold, 0 when uncapped","provider":"go.mondoo.com/mql/providers/databricks"},"minIdleInstances":{"name":"minIdleInstances","type":"\u0005","is_mandatory":true,"title":"Instances kept warm and ready for attachment","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Pool name","provider":"go.mondoo.com/mql/providers/databricks"},"nodeTypeId":{"name":"nodeTypeId","type":"\u0007","is_mandatory":true,"title":"Cloud node type the pool provisions","provider":"go.mondoo.com/mql/providers/databricks"},"permissions":{"name":"permissions","type":"\u0019\u001bdatabricks.permission","title":"Workspace access control list of the pool","provider":"go.mondoo.com/mql/providers/databricks"},"preloadedDockerImageUrls":{"name":"preloadedDockerImageUrls","type":"\u0019\u0007","is_mandatory":true,"title":"URLs of container images kept preloaded on idle instances","desc":"Every cluster attaching to the pool can boot from these images without a pull. Registry credentials that may accompany an image are not exposed.","provider":"go.mondoo.com/mql/providers/databricks"},"preloadedSparkVersions":{"name":"preloadedSparkVersions","type":"\u0019\u0007","is_mandatory":true,"title":"Databricks Runtime versions kept preloaded on idle instances","provider":"go.mondoo.com/mql/providers/databricks"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current state (ACTIVE, STOPPED, or DELETED)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks instance pool","desc":"A pool of idle cloud instances that clusters draw nodes from, keyed by its pool id. A pool fixes node-level settings for every cluster that attaches to it, so the AWS instance profile, the preloaded container images, and the custom tags recorded here apply to workloads the pool's own definition never names. Select a pool by name, for example `databricks.instancePools.where(name == \"shared-pool\")`.","min_provider_version":"13.1.4","defaults":"name nodeTypeId state","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.instanceProfile":{"id":"databricks.instanceProfile","name":"databricks.instanceProfile","fields":{"iamRoleArn":{"name":"iamRoleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the AWS IAM role associated with the instance profile","provider":"go.mondoo.com/mql/providers/databricks"},"instanceProfileArn":{"name":"instanceProfileArn","type":"\u0007","is_mandatory":true,"title":"ARN of the instance profile registered with Databricks","provider":"go.mondoo.com/mql/providers/databricks"},"isMetaInstanceProfile":{"name":"isMetaInstanceProfile","type":"\u0004","is_mandatory":true,"title":"Whether the profile is a meta instance profile that can assume a wide range of roles","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"AWS instance profile","desc":"An AWS instance profile registered in the workspace that clusters can assume to obtain AWS credentials, keyed by its ARN. This is the legacy instance-profile credential path. A meta instance profile can assume a wide range of roles and warrants closer review. Covers the instance profile ARN, the associated IAM role ARN, and whether it is a meta instance profile. Select a profile by ARN, for example `databricks.instanceProfiles.where(isMetaInstanceProfile == true)`.","min_provider_version":"13.0.1","defaults":"instanceProfileArn isMetaInstanceProfile","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.ipAccessList":{"id":"databricks.ipAccessList","name":"databricks.ipAccessList","fields":{"addressCount":{"name":"addressCount","type":"\u0005","is_mandatory":true,"title":"Number of addresses in the list","provider":"go.mondoo.com/mql/providers/databricks"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the list is enforced","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"IP access list id","provider":"go.mondoo.com/mql/providers/databricks"},"ipAddresses":{"name":"ipAddresses","type":"\u0019\u0007","is_mandatory":true,"title":"CIDR ranges in the list","provider":"go.mondoo.com/mql/providers/databricks"},"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"List label","provider":"go.mondoo.com/mql/providers/databricks"},"listType":{"name":"listType","type":"\u0007","is_mandatory":true,"title":"List type (ALLOW or BLOCK)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks workspace IP access list","desc":"A list of IP ranges allowed or blocked from reaching a workspace, keyed by label. Covers the list type, the CIDR ranges it contains, and whether it is enabled. Select a list by label, for example `databricks.ipAccessLists.where(label == \"office\")`.","min_provider_version":"13.0.0","defaults":"label listType enabled","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.job":{"id":"databricks.job","name":"databricks.job","fields":{"continuousPauseStatus":{"name":"continuousPauseStatus","type":"\u0007","is_mandatory":true,"title":"Whether continuous execution is paused, PAUSED or UNPAUSED","desc":"Empty when the job does not run continuously.","provider":"go.mondoo.com/mql/providers/databricks"},"createdTime":{"name":"createdTime","type":"\t","is_mandatory":true,"title":"When the job was created","provider":"go.mondoo.com/mql/providers/databricks"},"creatorUserName":{"name":"creatorUserName","type":"\u0007","is_mandatory":true,"title":"User who created the job","provider":"go.mondoo.com/mql/providers/databricks"},"deploymentId":{"name":"deploymentId","type":"\u0007","is_mandatory":true,"title":"Identifier of the deployment managing the job, empty when not managed","provider":"go.mondoo.com/mql/providers/databricks"},"deploymentKind":{"name":"deploymentKind","type":"\u0007","is_mandatory":true,"title":"How the job is managed, BUNDLE or SYSTEM_MANAGED","desc":"Empty for a job defined directly in the workspace. A bundle-managed job is redeployed from source, so changes made in the workspace are transient.","provider":"go.mondoo.com/mql/providers/databricks"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Job description, empty when none is set","provider":"go.mondoo.com/mql/providers/databricks"},"editMode":{"name":"editMode","type":"\u0007","is_mandatory":true,"title":"Whether the job definition can be edited, UI_LOCKED or EDITABLE","provider":"go.mondoo.com/mql/providers/databricks"},"format":{"name":"format","type":"\u0007","is_mandatory":true,"title":"Task layout of the job, SINGLE_TASK or MULTI_TASK","provider":"go.mondoo.com/mql/providers/databricks"},"gitBranch":{"name":"gitBranch","type":"\u0007","is_mandatory":true,"title":"Git branch the source is pulled from, empty when pinned to a tag or commit","provider":"go.mondoo.com/mql/providers/databricks"},"gitCommit":{"name":"gitCommit","type":"\u0007","is_mandatory":true,"title":"Git commit the source is pinned to, empty when unused","provider":"go.mondoo.com/mql/providers/databricks"},"gitProvider":{"name":"gitProvider","type":"\u0007","is_mandatory":true,"title":"Git hosting provider, such as gitHub, gitLab, or bitbucketCloud","provider":"go.mondoo.com/mql/providers/databricks"},"gitTag":{"name":"gitTag","type":"\u0007","is_mandatory":true,"title":"Git tag the source is pinned to, empty when unused","provider":"go.mondoo.com/mql/providers/databricks"},"gitUrl":{"name":"gitUrl","type":"\u0007","is_mandatory":true,"title":"URL of the Git repository task source is pulled from","desc":"Empty when every task reads its source from the workspace instead. A job sourced from Git executes whatever the referenced branch, tag, or commit holds at run time.","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric job identifier","provider":"go.mondoo.com/mql/providers/databricks"},"jobClusters":{"name":"jobClusters","type":"\u0019\u001bdatabricks.clusterSpec","title":"Reusable compute definitions shared by the job's tasks","provider":"go.mondoo.com/mql/providers/databricks"},"maxConcurrentRuns":{"name":"maxConcurrentRuns","type":"\u0005","is_mandatory":true,"title":"Maximum number of runs that may execute concurrently","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Job name","provider":"go.mondoo.com/mql/providers/databricks"},"notificationEmails":{"name":"notificationEmails","type":"\u0019\u0007","is_mandatory":true,"title":"Email addresses notified about run outcomes","desc":"The union of the addresses configured across the start, success, failure, duration-warning, and streaming-backlog events.","provider":"go.mondoo.com/mql/providers/databricks"},"parentPath":{"name":"parentPath","type":"\u0007","is_mandatory":true,"title":"Workspace path the job definition lives under, empty when none is set","provider":"go.mondoo.com/mql/providers/databricks"},"performanceTarget":{"name":"performanceTarget","type":"\u0007","is_mandatory":true,"title":"Performance target for serverless runs, empty when unset","provider":"go.mondoo.com/mql/providers/databricks"},"permissions":{"name":"permissions","type":"\u0019\u001bdatabricks.permission","title":"Workspace access control list of the job","provider":"go.mondoo.com/mql/providers/databricks"},"policyCompliant":{"name":"policyCompliant","type":"\u0004","title":"Whether the job's compute satisfies the policies its job clusters are created against","desc":"A job drifts out of compliance when a policy is tightened after the job was defined, so this reports the live comparison. True for a job whose clusters reference no policy, since there is nothing to violate.","provider":"go.mondoo.com/mql/providers/databricks"},"policyViolations":{"name":"policyViolations","type":"\u001a\u0007\u0007","title":"Settings that violate the policies the job's clusters are created against","desc":"Each key names a cluster setting the policy rejects and its value describes the violation. Empty on a compliant job.","provider":"go.mondoo.com/mql/providers/databricks"},"runAs":{"name":"runAs","type":"\u0007","is_mandatory":true,"title":"Identity every run of the job executes as","desc":"The user name, service principal application id, or group name the job runs as. Defaults to the creator when the job sets no explicit identity, so a job created by a workspace admin runs with that admin's access until it is changed.","provider":"go.mondoo.com/mql/providers/databricks"},"runAsType":{"name":"runAsType","type":"\u0007","is_mandatory":true,"title":"Kind of identity the job runs as","desc":"One of USER, SERVICE_PRINCIPAL, or GROUP.","provider":"go.mondoo.com/mql/providers/databricks"},"scheduleCronExpression":{"name":"scheduleCronExpression","type":"\u0007","is_mandatory":true,"title":"Quartz cron expression driving the schedule, empty when unscheduled","provider":"go.mondoo.com/mql/providers/databricks"},"schedulePauseStatus":{"name":"schedulePauseStatus","type":"\u0007","is_mandatory":true,"title":"Whether the schedule is paused, PAUSED or UNPAUSED","desc":"Empty when the job carries no schedule.","provider":"go.mondoo.com/mql/providers/databricks"},"scheduleTimezoneId":{"name":"scheduleTimezoneId","type":"\u0007","is_mandatory":true,"title":"Java timezone id the schedule is evaluated in, empty when unscheduled","provider":"go.mondoo.com/mql/providers/databricks"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Tags applied to the job","provider":"go.mondoo.com/mql/providers/databricks"},"task":{"name":"task","type":"\u001bdatabricks.job.task","title":"Task of a Databricks job","desc":"A single unit of work within a job, selected by taskKey. Covers what the task executes and where that code comes from, whether it runs on a long-lived cluster or on compute created for the run, the libraries it installs, and the tasks it depends on.","is_private":true,"provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"tasks":{"name":"tasks","type":"\u0019\u001bdatabricks.job.task","title":"Tasks the job runs","provider":"go.mondoo.com/mql/providers/databricks"},"timeoutSeconds":{"name":"timeoutSeconds","type":"\u0005","is_mandatory":true,"title":"Run timeout in seconds, 0 when the job has no timeout","provider":"go.mondoo.com/mql/providers/databricks"},"trigger":{"name":"trigger","type":"\u001bdatabricks.job.trigger","title":"Trigger of a Databricks job","desc":"One entry in a job's trigger list, describing what starts a run and whether that trigger is currently active. The triggerType field names which kind the entry is, and only the fields belonging to that kind carry values. An unpaused trigger starts job code with no person involved, so the pause status and the source being watched are what an audit turns on: a file arrival trigger pointed at an external location means anything that can write a file there can start the job.","is_private":true,"provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"triggers":{"name":"triggers","type":"\u0019\u001bdatabricks.job.trigger","title":"Triggers that start runs of the job","desc":"A job may carry several triggers alongside its schedule, each watching a different source: a cron schedule, a fixed interval, files landing at a URL, table or model updates, or continuous execution. An unpaused trigger starts job code without anyone acting, so the sources listed here are the full set of things that can set the job running.","min_provider_version":"13.2.2","provider":"go.mondoo.com/mql/providers/databricks"},"webhookNotificationIds":{"name":"webhookNotificationIds","type":"\u0019\u0007","is_mandatory":true,"title":"Identifiers of the notification destinations webhooks are sent to","desc":"The union of the destination ids configured across every run event. Each id resolves to a workspace notification destination such as a Slack, Microsoft Teams, PagerDuty, or generic webhook target.","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks job","desc":"A job in the workspace, keyed by the numeric jobId. A job runs one or more tasks on a schedule or trigger under a single fixed identity, which makes it the main scheduled code-execution surface of a workspace. Covers the identity the job runs as, the schedule and its pause state, the concurrency and timeout limits, the Git remote that task source is pulled from, the notification targets that receive run outcomes, whether the job is managed by a deployment bundle, and the workspace access control list. Select a job by id, for example `databricks.jobs.where(id == 620813104278135)`.","min_provider_version":"13.1.4","defaults":"name runAs format","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.job.task":{"id":"databricks.job.task","name":"databricks.job.task","fields":{"dbtCommands":{"name":"dbtCommands","type":"\u0019\u0007","is_mandatory":true,"title":"dbt commands the task runs, empty for other task kinds","provider":"go.mondoo.com/mql/providers/databricks"},"dependsOn":{"name":"dependsOn","type":"\u0019\u0007","is_mandatory":true,"title":"Keys of the tasks that must finish before this one starts","provider":"go.mondoo.com/mql/providers/databricks"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Task description, empty when none is set","provider":"go.mondoo.com/mql/providers/databricks"},"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether the task is disabled and skipped by every run","provider":"go.mondoo.com/mql/providers/databricks"},"existingCluster":{"name":"existingCluster","type":"\u001bdatabricks.cluster","title":"Long-lived cluster the task runs on","provider":"go.mondoo.com/mql/providers/databricks"},"jobClusterKey":{"name":"jobClusterKey","type":"\u0007","is_mandatory":true,"title":"Key of the job cluster the task runs on, empty when it does not use one","provider":"go.mondoo.com/mql/providers/databricks"},"libraries":{"name":"libraries","type":"\u0019\n","is_mandatory":true,"title":"Libraries installed on the compute before the task runs","desc":"One entry per library, each with a type of jar, egg, whl, pypi, maven, cran, or requirements. Maven, PyPI, and CRAN entries carry the coordinate and the repository they are fetched from; the others carry the path.","provider":"go.mondoo.com/mql/providers/databricks"},"maxRetries":{"name":"maxRetries","type":"\u0005","is_mandatory":true,"title":"Maximum number of retries after a failed run","provider":"go.mondoo.com/mql/providers/databricks"},"newCluster":{"name":"newCluster","type":"\u001bdatabricks.clusterSpec","title":"Compute created for each run of the task","provider":"go.mondoo.com/mql/providers/databricks"},"notebookPath":{"name":"notebookPath","type":"\u0007","is_mandatory":true,"title":"Workspace or Git path of the notebook the task runs","desc":"Empty for tasks that do not run a notebook.","provider":"go.mondoo.com/mql/providers/databricks"},"notebookSource":{"name":"notebookSource","type":"\u0007","is_mandatory":true,"title":"Where notebook source is read from, WORKSPACE or GIT","desc":"Empty for tasks that do not run a notebook.","provider":"go.mondoo.com/mql/providers/databricks"},"pipeline":{"name":"pipeline","type":"\u001bdatabricks.pipeline","title":"Pipeline the task triggers","provider":"go.mondoo.com/mql/providers/databricks"},"sparkJarMainClass":{"name":"sparkJarMainClass","type":"\u0007","is_mandatory":true,"title":"Main class of the JAR the task runs, empty for other task kinds","provider":"go.mondoo.com/mql/providers/databricks"},"sparkPythonFile":{"name":"sparkPythonFile","type":"\u0007","is_mandatory":true,"title":"Path of the Python file the task runs, empty for other task kinds","provider":"go.mondoo.com/mql/providers/databricks"},"sparkSubmitParameters":{"name":"sparkSubmitParameters","type":"\u0019\u0007","is_mandatory":true,"title":"Parameters passed to spark-submit, empty for other task kinds","desc":"A spark-submit task bypasses the notebook and JAR entry points, so these parameters can carry arbitrary driver and executor configuration.","provider":"go.mondoo.com/mql/providers/databricks"},"taskKey":{"name":"taskKey","type":"\u0007","is_mandatory":true,"title":"Key identifying the task within its job","provider":"go.mondoo.com/mql/providers/databricks"},"taskType":{"name":"taskType","type":"\u0007","is_mandatory":true,"title":"Kind of work the task performs","desc":"Derived from the task definition. Values include notebook, spark_jar, spark_python, spark_submit, pipeline, sql, dbt, dbt_cloud, dbt_platform, python_wheel, python_operator, run_job, condition, for_each, dashboard, power_bi, alert, clean_rooms_notebook, ai_runtime, and gen_ai_compute. Empty when the task uses a kind this provider does not yet model.","provider":"go.mondoo.com/mql/providers/databricks"},"timeoutSeconds":{"name":"timeoutSeconds","type":"\u0005","is_mandatory":true,"title":"Run timeout in seconds, 0 when the task has no timeout","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Task of a Databricks job","desc":"A single unit of work within a job, selected by taskKey. Covers what the task executes and where that code comes from, whether it runs on a long-lived cluster or on compute created for the run, the libraries it installs, and the tasks it depends on.","private":true,"min_provider_version":"13.1.4","defaults":"taskKey taskType","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.job.trigger":{"id":"databricks.job.trigger","name":"databricks.job.trigger","fields":{"continuousTaskRetryMode":{"name":"continuousTaskRetryMode","type":"\u0007","is_mandatory":true,"title":"Retry behavior of a continuous trigger, empty for other kinds","provider":"go.mondoo.com/mql/providers/databricks"},"cronExpression":{"name":"cronExpression","type":"\u0007","is_mandatory":true,"title":"Quartz cron expression driving a schedule trigger, empty for other kinds","provider":"go.mondoo.com/mql/providers/databricks"},"fileArrivalUrl":{"name":"fileArrivalUrl","type":"\u0007","is_mandatory":true,"title":"URL a file arrival trigger monitors, empty for other kinds","desc":"Points at the root or a subpath of an external location. A file landing there starts a run, so write access to that location is effectively permission to execute the job.","provider":"go.mondoo.com/mql/providers/databricks"},"minTimeBetweenTriggersSeconds":{"name":"minTimeBetweenTriggersSeconds","type":"\u0005","is_mandatory":true,"title":"Minimum seconds between two firings of the trigger, 0 when unset","provider":"go.mondoo.com/mql/providers/databricks"},"modelAliases":{"name":"modelAliases","type":"\u0019\u0007","is_mandatory":true,"title":"Model version aliases a model trigger monitors","provider":"go.mondoo.com/mql/providers/databricks"},"modelCondition":{"name":"modelCondition","type":"\u0007","is_mandatory":true,"title":"Condition a model trigger fires on, empty for other kinds","provider":"go.mondoo.com/mql/providers/databricks"},"modelSecurableName":{"name":"modelSecurableName","type":"\u0007","is_mandatory":true,"title":"Securable a model trigger monitors, empty for other kinds","desc":"Names a model as catalog.schema.model, a schema as catalog.schema, or is empty for a metastore-level trigger.","provider":"go.mondoo.com/mql/providers/databricks"},"pauseStatus":{"name":"pauseStatus","type":"\u0007","is_mandatory":true,"title":"Whether the trigger is paused, PAUSED or UNPAUSED","provider":"go.mondoo.com/mql/providers/databricks"},"periodicInterval":{"name":"periodicInterval","type":"\u0005","is_mandatory":true,"title":"Interval a periodic trigger fires on, 0 for other kinds","provider":"go.mondoo.com/mql/providers/databricks"},"periodicUnit":{"name":"periodicUnit","type":"\u0007","is_mandatory":true,"title":"Unit of the periodic interval","desc":"One of DAYS, HOURS, MINUTES, or WEEKS. Empty for other kinds.","provider":"go.mondoo.com/mql/providers/databricks"},"sqlConditionQueryId":{"name":"sqlConditionQueryId","type":"\u0007","is_mandatory":true,"title":"Identifier of the SQL query gating whether the trigger fires","desc":"Empty when the trigger is ungated. A gated trigger fires only when the query result satisfies the trigger mode.","provider":"go.mondoo.com/mql/providers/databricks"},"sqlConditionTriggerMode":{"name":"sqlConditionTriggerMode","type":"\u0007","is_mandatory":true,"title":"How the gating query result is read, empty when ungated","provider":"go.mondoo.com/mql/providers/databricks"},"sqlConditionWarehouseId":{"name":"sqlConditionWarehouseId","type":"\u0007","is_mandatory":true,"title":"Identifier of the SQL warehouse the gating query runs against, empty when ungated","provider":"go.mondoo.com/mql/providers/databricks"},"tableNames":{"name":"tableNames","type":"\u0019\u0007","is_mandatory":true,"title":"Tables a table update trigger monitors, each as catalog.schema.table","provider":"go.mondoo.com/mql/providers/databricks"},"tableUpdateCondition":{"name":"tableUpdateCondition","type":"\u0007","is_mandatory":true,"title":"Condition a table update trigger fires on, empty for other kinds","provider":"go.mondoo.com/mql/providers/databricks"},"timezoneId":{"name":"timezoneId","type":"\u0007","is_mandatory":true,"title":"Java timezone id a schedule trigger is evaluated in, empty for other kinds","provider":"go.mondoo.com/mql/providers/databricks"},"triggerType":{"name":"triggerType","type":"\u0007","is_mandatory":true,"title":"Kind of trigger","desc":"One of schedule, periodic, file_arrival, table_update, model, or continuous. Reports unknown when the SDK models a kind this provider does not yet classify, so a trigger never silently disappears from the list.","provider":"go.mondoo.com/mql/providers/databricks"},"waitAfterLastChangeSeconds":{"name":"waitAfterLastChangeSeconds","type":"\u0005","is_mandatory":true,"title":"Seconds of inactivity awaited before the trigger fires, 0 when unset","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Trigger of a Databricks job","desc":"One entry in a job's trigger list, describing what starts a run and whether that trigger is currently active. The triggerType field names which kind the entry is, and only the fields belonging to that kind carry values. An unpaused trigger starts job code with no person involved, so the pause status and the source being watched are what an audit turns on: a file arrival trigger pointed at an external location means anything that can write a file there can start the job.","private":true,"min_provider_version":"13.2.2","defaults":"triggerType pauseStatus","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.logDelivery":{"id":"databricks.logDelivery","name":"databricks.logDelivery","fields":{"configName":{"name":"configName","type":"\u0007","is_mandatory":true,"title":"Configuration name","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the configuration was created","provider":"go.mondoo.com/mql/providers/databricks"},"credentialConfiguration":{"name":"credentialConfiguration","type":"\u001bdatabricks.credentialConfiguration","title":"Credential configuration used to write the logs","provider":"go.mondoo.com/mql/providers/databricks"},"deliveryPathPrefix":{"name":"deliveryPathPrefix","type":"\u0007","is_mandatory":true,"title":"Path prefix within the storage bucket the logs are written under","provider":"go.mondoo.com/mql/providers/databricks"},"deliveryStartTime":{"name":"deliveryStartTime","type":"\u0007","is_mandatory":true,"title":"Date delivery starts from, in YYYY-MM format","provider":"go.mondoo.com/mql/providers/databricks"},"deliveryStatus":{"name":"deliveryStatus","type":"\u0007","is_mandatory":true,"title":"Outcome of the most recent delivery attempt, such as CREATED, SUCCEEDED, USER_FAILURE, SYSTEM_FAILURE, or NOT_FOUND","provider":"go.mondoo.com/mql/providers/databricks"},"deliveryStatusMessage":{"name":"deliveryStatusMessage","type":"\u0007","is_mandatory":true,"title":"Detail accompanying the most recent delivery attempt","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Configuration id","provider":"go.mondoo.com/mql/providers/databricks"},"lastAttemptTime":{"name":"lastAttemptTime","type":"\u0007","is_mandatory":true,"title":"When delivery was last attempted","provider":"go.mondoo.com/mql/providers/databricks"},"lastSuccessfulAttemptTime":{"name":"lastSuccessfulAttemptTime","type":"\u0007","is_mandatory":true,"title":"When delivery last succeeded","desc":"A configuration whose last success trails its last attempt is failing to deliver, which leaves a gap in the log record even though the configuration reports as enabled.","provider":"go.mondoo.com/mql/providers/databricks"},"logType":{"name":"logType","type":"\u0007","is_mandatory":true,"title":"Kind of log delivered, AUDIT_LOGS or BILLABLE_USAGE","provider":"go.mondoo.com/mql/providers/databricks"},"outputFormat":{"name":"outputFormat","type":"\u0007","is_mandatory":true,"title":"File format of the delivered logs, JSON or CSV","provider":"go.mondoo.com/mql/providers/databricks"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Whether the configuration is delivering, ENABLED or DISABLED","desc":"A disabled configuration is retained but ships nothing, so its presence is not evidence that logs are being collected.","provider":"go.mondoo.com/mql/providers/databricks"},"storageConfiguration":{"name":"storageConfiguration","type":"\u001bdatabricks.storageConfiguration","title":"Storage configuration the logs are written to","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the configuration was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"workspaceIdsFilter":{"name":"workspaceIdsFilter","type":"\u0019\u0005","is_mandatory":true,"title":"Workspaces the configuration covers","desc":"Empty for an account-level configuration, which covers every workspace including ones created later. A non-empty list covers only the workspaces named in it.","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Log delivery configuration","desc":"A configuration that ships account logs to customer-owned cloud storage, keyed by its configuration id. The logType field separates the two kinds: AUDIT_LOGS carries the record of workspace and account activity, and BILLABLE_USAGE carries consumption. Auditing these answers whether audit logging is turned on at all, where the logs land, which workspaces are covered, and whether delivery is actually succeeding. Select a configuration by log type, for example `databricks.logDeliveryConfigurations.where(logType == \"AUDIT_LOGS\")`.","min_provider_version":"13.1.4","defaults":"configName logType status","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.metastore":{"id":"databricks.metastore","name":"databricks.metastore","fields":{"cloud":{"name":"cloud","type":"\u0007","is_mandatory":true,"title":"Hosting cloud","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the metastore was created","provider":"go.mondoo.com/mql/providers/databricks"},"deltaSharingRecipientTokenLifetimeInSeconds":{"name":"deltaSharingRecipientTokenLifetimeInSeconds","type":"\u0005","is_mandatory":true,"title":"Lifetime in seconds of Delta Sharing recipient tokens","provider":"go.mondoo.com/mql/providers/databricks"},"deltaSharingScope":{"name":"deltaSharingScope","type":"\u0007","is_mandatory":true,"title":"Delta Sharing scope","desc":"One of INTERNAL or INTERNAL_AND_EXTERNAL. INTERNAL_AND_EXTERNAL enables open Delta Sharing outside the account.","provider":"go.mondoo.com/mql/providers/databricks"},"externalAccessEnabled":{"name":"externalAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether external engines may read managed tables through open APIs","provider":"go.mondoo.com/mql/providers/databricks"},"globalMetastoreId":{"name":"globalMetastoreId","type":"\u0007","is_mandatory":true,"title":"Global metastore id (cloud:region:id)","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Metastore id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Metastore name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the metastore","provider":"go.mondoo.com/mql/providers/databricks"},"privilegeModelVersion":{"name":"privilegeModelVersion","type":"\u0007","is_mandatory":true,"title":"Unity Catalog privilege model version","provider":"go.mondoo.com/mql/providers/databricks"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Hosting region","provider":"go.mondoo.com/mql/providers/databricks"},"storageRoot":{"name":"storageRoot","type":"\u0007","is_mandatory":true,"title":"Cloud storage root backing the metastore","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog metastore","desc":"A Unity Catalog metastore registered in the account, keyed by name. Covers the owner, hosting cloud and region, storage root, the Delta Sharing scope and recipient token lifetime, and whether external access is enabled. Select a metastore by name, for example `databricks.metastores.where(name == \"primary\")`.","min_provider_version":"13.0.0","defaults":"name owner region","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.modelVersion":{"id":"databricks.modelVersion","name":"databricks.modelVersion","fields":{"aliases":{"name":"aliases","type":"\u0019\n","is_mandatory":true,"title":"Aliases pointing at the version","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Version comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the version was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the version","provider":"go.mondoo.com/mql/providers/databricks"},"modelName":{"name":"modelName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the parent registered model","provider":"go.mondoo.com/mql/providers/databricks"},"runId":{"name":"runId","type":"\u0007","is_mandatory":true,"title":"MLflow run id used when creating the version, empty when not generated by a run","provider":"go.mondoo.com/mql/providers/databricks"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"URI locating the source artifacts for the version","provider":"go.mondoo.com/mql/providers/databricks"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Registration status","desc":"One of PENDING_REGISTRATION, FAILED_REGISTRATION, READY, or MODEL_VERSION_STATUS_UNKNOWN. Only READY versions can be loaded for inference or served.","provider":"go.mondoo.com/mql/providers/databricks"},"storageLocation":{"name":"storageLocation","type":"\u0007","is_mandatory":true,"title":"Cloud storage path under which the version data files are stored","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the version was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Integer version number","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog model version","desc":"A single version of a Unity Catalog registered model, keyed by the parent model's fully qualified name and the version number. Covers the registration status, the source artifact location, the MLflow run that produced it, the storage location backing its files, and the aliases pointing at it.","min_provider_version":"13.0.1","defaults":"modelName version status","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.network":{"id":"databricks.network","name":"databricks.network","fields":{"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Network configuration id","provider":"go.mondoo.com/mql/providers/databricks"},"networkName":{"name":"networkName","type":"\u0007","is_mandatory":true,"title":"Network configuration name","provider":"go.mondoo.com/mql/providers/databricks"},"securityGroupIds":{"name":"securityGroupIds","type":"\u0019\u0007","is_mandatory":true,"title":"Security group ids attached to the network","provider":"go.mondoo.com/mql/providers/databricks"},"subnetIds":{"name":"subnetIds","type":"\u0019\u0007","is_mandatory":true,"title":"Subnet ids attached to the network","provider":"go.mondoo.com/mql/providers/databricks"},"vpcId":{"name":"vpcId","type":"\u0007","is_mandatory":true,"title":"Cloud VPC id","provider":"go.mondoo.com/mql/providers/databricks"},"vpcStatus":{"name":"vpcStatus","type":"\u0007","is_mandatory":true,"title":"VPC validation status","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks account network","desc":"A customer-managed network registered in the account for workspace deployment, keyed by networkName. Covers the cloud network identifiers (VPC, subnets, security groups) and their validation status. Select a network by name, for example `databricks.networks.where(networkName == \"prod-vpc\")`.","min_provider_version":"13.0.0","defaults":"networkName vpcId","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.networkPolicy":{"id":"databricks.networkPolicy","name":"databricks.networkPolicy","fields":{"allowedInternetDestinations":{"name":"allowedInternetDestinations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Internet destinations serverless compute may reach, keyed by destination","desc":"Each key is a hostname and its value is the destination type, such as FQDN. Empty under RESTRICTED_ACCESS means no internet destination is reachable beyond the Databricks control plane.","provider":"go.mondoo.com/mql/providers/databricks"},"allowedStorageDestinations":{"name":"allowedStorageDestinations","type":"\u0019\n","is_mandatory":true,"title":"Storage destinations serverless compute may reach","desc":"One entry per destination, each with a `type` of AWS_S3 or AZURE_STORAGE, and the `bucketName` and `region`, or the `azureStorageAccount` and `azureStorageService`, that identify it.","provider":"go.mondoo.com/mql/providers/databricks"},"blockedInternetDestinations":{"name":"blockedInternetDestinations","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Internet destinations serverless compute may not reach, keyed by destination","provider":"go.mondoo.com/mql/providers/databricks"},"egressDryRunProductFilter":{"name":"egressDryRunProductFilter","type":"\u0019\u0007","is_mandatory":true,"title":"Products the policy is only dry-run for, such as DBSQL or ML_SERVING","provider":"go.mondoo.com/mql/providers/databricks"},"egressEnforcementMode":{"name":"egressEnforcementMode","type":"\u0007","is_mandatory":true,"title":"Whether the policy is applied or only observed","desc":"ENFORCED blocks traffic outside the policy. DRY_RUN records what would have been blocked and permits it, so a policy in dry-run mode restricts nothing.","provider":"go.mondoo.com/mql/providers/databricks"},"egressRestrictionMode":{"name":"egressRestrictionMode","type":"\u0007","is_mandatory":true,"title":"How far serverless egress may reach","desc":"FULL_ACCESS permits any destination. RESTRICTED_ACCESS permits only the Databricks control plane and the destinations listed on the policy.","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Policy id","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Account network policy","desc":"The egress firewall applied to serverless compute in the account, keyed by its policy id. Serverless workloads run outside the customer's network, so this policy is what bounds where they may reach; without it a notebook on serverless compute can call any internet destination. Auditing it surfaces the restriction mode, the destinations explicitly allowed or blocked, and whether the policy is enforced or only logging. Select a policy by id, for example `databricks.networkPolicies.where(id == \"np-1\")`.","min_provider_version":"13.1.4","defaults":"id egressRestrictionMode egressEnforcementMode","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.permission":{"id":"databricks.permission","name":"databricks.permission","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the principal, empty when the API returns none","provider":"go.mondoo.com/mql/providers/databricks"},"inherited":{"name":"inherited","type":"\u0004","is_mandatory":true,"title":"Whether the level comes from a parent object rather than this object","provider":"go.mondoo.com/mql/providers/databricks"},"inheritedFromObject":{"name":"inheritedFromObject","type":"\u0019\u0007","is_mandatory":true,"title":"Parent objects the level is inherited from, empty for a direct assignment","provider":"go.mondoo.com/mql/providers/databricks"},"objectId":{"name":"objectId","type":"\u0007","is_mandatory":true,"title":"Identifier of the object the permission applies to","provider":"go.mondoo.com/mql/providers/databricks"},"objectType":{"name":"objectType","type":"\u0007","is_mandatory":true,"title":"Access control object type the permission applies to","desc":"The path segment the workspace permissions API uses, such as clusters, cluster-policies, jobs, pipelines, sql/warehouses, or serving-endpoints.","provider":"go.mondoo.com/mql/providers/databricks"},"permissionLevel":{"name":"permissionLevel","type":"\u0007","is_mandatory":true,"title":"Permission level held on the object","desc":"The available levels depend on the object type. Common levels include IS_OWNER, CAN_MANAGE, CAN_MANAGE_RUN, CAN_RESTART, CAN_ATTACH_TO, CAN_USE, CAN_VIEW, and CAN_RUN.","provider":"go.mondoo.com/mql/providers/databricks"},"principal":{"name":"principal","type":"\u0007","is_mandatory":true,"title":"Name of the principal holding the permission","desc":"The user name for a user, the display name for a group, or the application id for a service principal.","provider":"go.mondoo.com/mql/providers/databricks"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Kind of principal holding the permission","desc":"One of USER, GROUP, or SERVICE_PRINCIPAL.","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Workspace access control entry","desc":"A single permission level held by one principal on one workspace object such as a cluster, cluster policy, SQL warehouse, job, pipeline, or model serving endpoint. Workspace access control is separate from Unity Catalog privileges, which are covered by databricks.grant, and governs who may view, run, attach to, restart, or manage an object rather than who may read its data. Covers the principal and its kind, the permission level, and whether the level is held directly or comes from a parent object.","min_provider_version":"13.1.4","defaults":"principal permissionLevel objectType","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.pipeline":{"id":"databricks.pipeline","name":"databricks.pipeline","fields":{"catalog":{"name":"catalog","type":"\u0007","title":"Unity Catalog catalog the pipeline publishes into","desc":"Empty when the pipeline publishes to the legacy Hive metastore instead, in which case its output sits outside Unity Catalog governance.","provider":"go.mondoo.com/mql/providers/databricks"},"channel":{"name":"channel","type":"\u0007","title":"Release channel of the runtime, CURRENT or PREVIEW","provider":"go.mondoo.com/mql/providers/databricks"},"clusters":{"name":"clusters","type":"\u0019\u001bdatabricks.clusterSpec","title":"Compute definitions the pipeline creates for its updates","provider":"go.mondoo.com/mql/providers/databricks"},"configuration":{"name":"configuration","type":"\u001a\u0007\u0007","title":"Configuration entries passed to the pipeline","desc":"These become Spark configuration on the pipeline compute and are a common place for connection settings to be stored in plain text.","provider":"go.mondoo.com/mql/providers/databricks"},"continuous":{"name":"continuous","type":"\u0004","title":"Whether the pipeline runs continuously rather than on triggered updates","provider":"go.mondoo.com/mql/providers/databricks"},"creatorUserName":{"name":"creatorUserName","type":"\u0007","is_mandatory":true,"title":"User who created the pipeline","provider":"go.mondoo.com/mql/providers/databricks"},"development":{"name":"development","type":"\u0004","title":"Whether the pipeline runs in development mode","desc":"A development pipeline reuses its compute between updates and skips retries, so it is not intended for production workloads.","provider":"go.mondoo.com/mql/providers/databricks"},"edition":{"name":"edition","type":"\u0007","title":"Product edition, such as CORE, PRO, or ADVANCED","provider":"go.mondoo.com/mql/providers/databricks"},"health":{"name":"health","type":"\u0007","is_mandatory":true,"title":"Health of the most recent update, HEALTHY or UNHEALTHY","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique pipeline identifier","provider":"go.mondoo.com/mql/providers/databricks"},"libraries":{"name":"libraries","type":"\u0019\n","title":"Libraries the pipeline executes","desc":"One entry per library, each with a type of notebook, file, jar, whl, maven, or glob, and the path or coordinate it resolves to.","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Pipeline name","provider":"go.mondoo.com/mql/providers/databricks"},"permissions":{"name":"permissions","type":"\u0019\u001bdatabricks.permission","title":"Workspace access control list of the pipeline","provider":"go.mondoo.com/mql/providers/databricks"},"photon":{"name":"photon","type":"\u0004","title":"Whether Photon acceleration is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"rootPath":{"name":"rootPath","type":"\u0007","title":"Workspace path the pipeline source is rooted at, empty when none is set","provider":"go.mondoo.com/mql/providers/databricks"},"runAs":{"name":"runAs","type":"\u0007","is_mandatory":true,"title":"Identity every update of the pipeline executes as","desc":"The user name or service principal application id the pipeline runs as. Defaults to the creator when the pipeline sets no explicit identity.","provider":"go.mondoo.com/mql/providers/databricks"},"schema":{"name":"schema","type":"\u0007","title":"Schema the pipeline publishes into, empty when none is set","provider":"go.mondoo.com/mql/providers/databricks"},"serverless":{"name":"serverless","type":"\u0004","title":"Whether the pipeline runs on serverless compute","provider":"go.mondoo.com/mql/providers/databricks"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current lifecycle state, such as IDLE, RUNNING, DEPLOYING, or FAILED","provider":"go.mondoo.com/mql/providers/databricks"},"storage":{"name":"storage","type":"\u0007","title":"Root storage location for pipeline data and logs","desc":"Empty when the pipeline stores its data under a Unity Catalog managed location. A value pointing at DBFS keeps pipeline output outside Unity Catalog governance.","provider":"go.mondoo.com/mql/providers/databricks"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","title":"Tags applied to the pipeline","provider":"go.mondoo.com/mql/providers/databricks"},"target":{"name":"target","type":"\u0007","title":"Legacy target schema the pipeline publishes into, empty when none is set","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Delta Live Tables pipeline","desc":"A declarative data-processing pipeline in the workspace, keyed by pipelineId. A pipeline runs its libraries as code on compute it creates, which makes it the second scheduled execution surface of a workspace alongside databricks.job. Covers the identity the pipeline runs as, whether it publishes into Unity Catalog or into a storage location outside it, the runtime channel and edition, whether it runs in development mode, the libraries it executes, the compute it creates, and the workspace access control list. Select a pipeline by id, for example `databricks.pipelines.where(id == \"a1b2c3d4-0000-1111-2222-333344445555\")`.","min_provider_version":"13.1.4","defaults":"name state runAs","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.privateAccessSetting":{"id":"databricks.privateAccessSetting","name":"databricks.privateAccessSetting","fields":{"allowedVpcEndpointIds":{"name":"allowedVpcEndpointIds","type":"\u0019\u0007","is_mandatory":true,"title":"VPC endpoint ids allowed to reach the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Private access settings id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Private access settings name","provider":"go.mondoo.com/mql/providers/databricks"},"privateAccessLevel":{"name":"privateAccessLevel","type":"\u0007","is_mandatory":true,"title":"Private access level","desc":"One of ACCOUNT (any endpoint in the account) or ENDPOINT (only the listed endpoints).","provider":"go.mondoo.com/mql/providers/databricks"},"publicAccessEnabled":{"name":"publicAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the workspace is also reachable over the public internet","provider":"go.mondoo.com/mql/providers/databricks"},"region":{"name":"region","type":"\u0007","is_mandatory":true,"title":"Region the settings apply to","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks private access settings","desc":"Private connectivity settings that govern how a workspace is reached over the cloud provider's private network, keyed by name. Covers whether public access is allowed alongside private access, the private access level, and the VPC endpoints permitted to reach the workspace. Select a setting by name, for example `databricks.privateAccessSettings.where(name == \"prod-pas\")`.","min_provider_version":"13.0.0","defaults":"name publicAccessEnabled privateAccessLevel","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.registeredModel":{"id":"databricks.registeredModel","name":"databricks.registeredModel","fields":{"aliases":{"name":"aliases","type":"\u0019\n","is_mandatory":true,"title":"Aliases associated with the model, each pointing at a model version","provider":"go.mondoo.com/mql/providers/databricks"},"browseOnly":{"name":"browseOnly","type":"\u0004","is_mandatory":true,"title":"Whether the principal is limited to browsing metadata through the BROWSE privilege","provider":"go.mondoo.com/mql/providers/databricks"},"catalog":{"name":"catalog","type":"\u001bdatabricks.catalog","title":"Parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"catalogName":{"name":"catalogName","type":"\u0007","is_mandatory":true,"title":"Name of the parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Model comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the model was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the model","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name (catalog.schema.model)","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the model","provider":"go.mondoo.com/mql/providers/databricks"},"modelVersions":{"name":"modelVersions","type":"\u0019\u001bdatabricks.modelVersion","title":"Model versions contained in the model","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Model name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the model","provider":"go.mondoo.com/mql/providers/databricks"},"schema":{"name":"schema","type":"\u001bdatabricks.schema","title":"Parent schema","provider":"go.mondoo.com/mql/providers/databricks"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Name of the parent schema","provider":"go.mondoo.com/mql/providers/databricks"},"storageLocation":{"name":"storageLocation","type":"\u0007","is_mandatory":true,"title":"Cloud storage path under which model version files are stored","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the model was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the model","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog registered model","desc":"A registered model in Unity Catalog, keyed by its three-level fully qualified name (catalog.schema.model). Covers the owner, comment, storage location backing the model version files, the parent catalog and schema, the aliases pointing at model versions, the privilege grants assigned on it, and the model versions it contains. Select a model by full name, for example `databricks.registeredModels.where(name == \"fraud_detector\")`.","min_provider_version":"13.0.1","defaults":"fullName owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.repo":{"id":"databricks.repo","name":"databricks.repo","fields":{"branch":{"name":"branch","type":"\u0007","is_mandatory":true,"title":"Branch the checkout tracks, empty when pinned to a tag or commit","provider":"go.mondoo.com/mql/providers/databricks"},"headCommitId":{"name":"headCommitId","type":"\u0007","is_mandatory":true,"title":"Commit the checkout currently sits on","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric identifier of the Git folder","provider":"go.mondoo.com/mql/providers/databricks"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Workspace path the repository is checked out at","provider":"go.mondoo.com/mql/providers/databricks"},"permissions":{"name":"permissions","type":"\u0019\u001bdatabricks.permission","title":"Workspace access control list of the Git folder","provider":"go.mondoo.com/mql/providers/databricks"},"provider":{"name":"provider","type":"\u0007","is_mandatory":true,"title":"Git hosting provider, such as gitHub, gitLab, bitbucketCloud, or azureDevOpsServices","provider":"go.mondoo.com/mql/providers/databricks"},"sparseCheckoutPatterns":{"name":"sparseCheckoutPatterns","type":"\u0019\u0007","is_mandatory":true,"title":"Directory patterns limiting what the checkout pulls","desc":"Empty when the whole repository is checked out. A sparse checkout narrows what reaches the workspace but does not restrict what a user with write access can add later.","provider":"go.mondoo.com/mql/providers/databricks"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Remote URL the repository is cloned from","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Git folder in the workspace","desc":"A Git repository checked out into the workspace, keyed by its numeric id. Git folders are how external source enters the workspace, so auditing them surfaces the remote URL and hosting provider, the branch and commit the checkout currently sits on, the workspace path the code is mounted at, the sparse-checkout patterns limiting what is pulled, and the access control list governing who can change any of it. Select a folder by path, for example `databricks.repos.where(path == \"/Repos/prod/etl\")`.","min_provider_version":"13.1.4","defaults":"path url branch","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.schema":{"id":"databricks.schema","name":"databricks.schema","fields":{"catalog":{"name":"catalog","type":"\u001bdatabricks.catalog","title":"Parent catalog","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"catalogName":{"name":"catalogName","type":"\u0007","is_mandatory":true,"title":"Name of the parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Schema comment","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name (catalog.schema)","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the schema","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Schema id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Schema name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the schema","provider":"go.mondoo.com/mql/providers/databricks"},"volumes":{"name":"volumes","type":"\u0019\u001bdatabricks.volume","title":"Unity Catalog volumes in the schema","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog schema","desc":"A schema within a Unity Catalog catalog, keyed by its fully qualified name (catalog.schema). Covers the owner, the parent catalog, and the privilege grants assigned on it. Select a schema by full name, for example `databricks.catalogs.where(name == \"main\").schemas.where(name == \"sales\")`.","min_provider_version":"13.0.0","defaults":"fullName owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.secretScope":{"id":"databricks.secretScope","name":"databricks.secretScope","fields":{"acls":{"name":"acls","type":"\u001a\u0007\u0007","title":"Access-control list mapping each principal to its permission (MANAGE, READ, or WRITE)","provider":"go.mondoo.com/mql/providers/databricks"},"backendType":{"name":"backendType","type":"\u0007","is_mandatory":true,"title":"Backend storing the secrets (DATABRICKS or AZURE_KEYVAULT)","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Scope name","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks secret scope","desc":"A secret scope in the workspace, keyed by name. Covers the backend storing the secrets (a Databricks-managed store or an Azure Key Vault) and the access-control list mapping each principal to its permission on the scope. Select a scope by name, for example `databricks.secretScopes.where(name == \"prod\")`.","min_provider_version":"13.0.0","defaults":"name backendType","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.servicePrincipal":{"id":"databricks.servicePrincipal","name":"databricks.servicePrincipal","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the service principal is active","provider":"go.mondoo.com/mql/providers/databricks"},"applicationId":{"name":"applicationId","type":"\u0007","is_mandatory":true,"title":"OAuth client id","provider":"go.mondoo.com/mql/providers/databricks"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/providers/databricks"},"entitlements":{"name":"entitlements","type":"\u0019\u0007","is_mandatory":true,"title":"Entitlements granted to the service principal","provider":"go.mondoo.com/mql/providers/databricks"},"externalId":{"name":"externalId","type":"\u0007","is_mandatory":true,"title":"External identity provider id","provider":"go.mondoo.com/mql/providers/databricks"},"federationPolicies":{"name":"federationPolicies","type":"\u0019\u001bdatabricks.federationPolicy","title":"OIDC federation policies letting external workloads authenticate as this service principal","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"groups":{"name":"groups","type":"\u0019\u001bdatabricks.group","title":"Groups the service principal belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SCIM id","provider":"go.mondoo.com/mql/providers/databricks"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Cloud roles granted to the service principal","provider":"go.mondoo.com/mql/providers/databricks"},"secret":{"name":"secret","type":"\u001bdatabricks.servicePrincipal.secret","title":"OAuth secret of a service principal","desc":"A client secret issued to an account service principal, keyed by its secret id. The secret value is returned only at creation and is never readable afterwards, so what is auditable is its age and lifecycle: when it was created, whether it carries an expiry, and whether it is still active. A service principal holding an old secret with no expiry is a standing credential for whatever that principal can reach.","is_private":true,"provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"secrets":{"name":"secrets","type":"\u0019\u001bdatabricks.servicePrincipal.secret","title":"OAuth secrets issued to the service principal","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks account service principal","desc":"A machine identity provisioned in the Databricks account through SCIM, keyed by applicationId (the OAuth client id). Covers the active state, account-level entitlements, cloud roles, and group memberships. Select a service principal by application id, for example `databricks.servicePrincipals.where(applicationId == \"...\")`.","min_provider_version":"13.0.0","defaults":"displayName applicationId active","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.servicePrincipal.secret":{"id":"databricks.servicePrincipal.secret","name":"databricks.servicePrincipal.secret","fields":{"createTime":{"name":"createTime","type":"\t","is_mandatory":true,"title":"When the secret was created","provider":"go.mondoo.com/mql/providers/databricks"},"expireTime":{"name":"expireTime","type":"\t","is_mandatory":true,"title":"When the secret expires, null when the secret does not expire","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Secret id","provider":"go.mondoo.com/mql/providers/databricks"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Lifecycle status of the secret, such as ACTIVE","provider":"go.mondoo.com/mql/providers/databricks"},"updateTime":{"name":"updateTime","type":"\t","is_mandatory":true,"title":"When the secret was last updated","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"OAuth secret of a service principal","desc":"A client secret issued to an account service principal, keyed by its secret id. The secret value is returned only at creation and is never readable afterwards, so what is auditable is its age and lifecycle: when it was created, whether it carries an expiry, and whether it is still active. A service principal holding an old secret with no expiry is a standing credential for whatever that principal can reach.","private":true,"min_provider_version":"13.1.4","defaults":"id status expireTime","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.servingEndpoint":{"id":"databricks.servingEndpoint","name":"databricks.servingEndpoint","fields":{"aiGateway":{"name":"aiGateway","type":"\u001bdatabricks.servingEndpoint.gatewayConfig","title":"AI Gateway governance configured on the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"budgetPolicyId":{"name":"budgetPolicyId","type":"\u0007","is_mandatory":true,"title":"Id of the budget policy associated with the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"configUpdate":{"name":"configUpdate","type":"\u0007","is_mandatory":true,"title":"State of a pending configuration update","desc":"IN_PROGRESS while an update is being applied, UPDATE_FAILED when the last update failed, and NOT_UPDATING when there is no update in progress.","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the endpoint was created","provider":"go.mondoo.com/mql/providers/databricks"},"creator":{"name":"creator","type":"\u0007","is_mandatory":true,"title":"Email of the user that created the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Endpoint description","provider":"go.mondoo.com/mql/providers/databricks"},"gatewayConfig":{"name":"gatewayConfig","type":"\u001bdatabricks.servingEndpoint.gatewayConfig","title":"AI Gateway configuration on a model serving endpoint","is_private":true,"provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"System-generated endpoint id used by the Permissions API","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Endpoint name","provider":"go.mondoo.com/mql/providers/databricks"},"permissions":{"name":"permissions","type":"\u0019\u001bdatabricks.permission","title":"Workspace access control list of the endpoint","desc":"Null on a foundation model endpoint, which carries no identifier the permissions API can be keyed on. A null here means the access control list could not be read, not that no principal holds access to the endpoint.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"routeOptimized":{"name":"routeOptimized","type":"\u0004","title":"Whether route optimization is enabled for the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"servedEntities":{"name":"servedEntities","type":"\u0019\u001bdatabricks.servingEndpoint.servedEntity","title":"Served entities (models) fronted by the endpoint","provider":"go.mondoo.com/mql/providers/databricks"},"servedEntity":{"name":"servedEntity","type":"\u001bdatabricks.servingEndpoint.servedEntity","title":"Served entity behind a model serving endpoint","is_private":true,"provider":"go.mondoo.com/mql/providers/databricks","is_implicit_resource":true},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether the endpoint is queryable","desc":"READY when every served entity in the active configuration is ready, NOT_READY when any actively served entity is in a non-ready state.","provider":"go.mondoo.com/mql/providers/databricks"},"tags":{"name":"tags","type":"\u0019\n","is_mandatory":true,"title":"Tags attached to the endpoint, each with a key and value","provider":"go.mondoo.com/mql/providers/databricks"},"task":{"name":"task","type":"\u0007","is_mandatory":true,"title":"Task type served by the endpoint (such as llm/v1/chat or llm/v1/completions)","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the endpoint was last updated by a user","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Mosaic AI model serving endpoint","desc":"A Mosaic AI model serving endpoint in the workspace, keyed by name. Covers the endpoint state and pending configuration update, the creator, the task type, the budget policy, and the creation and update times. The served entities behind the endpoint are exposed through servedEntities, and the AI Gateway governance (usage tracking, inference-table payload logging, guardrails, and rate limits) through aiGateway. Select an endpoint by name, for example `databricks.servingEndpoints.where(name == \"prod-llm\")`.","min_provider_version":"13.0.1","defaults":"name state task","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.servingEndpoint.gatewayConfig":{"id":"databricks.servingEndpoint.gatewayConfig","name":"databricks.servingEndpoint.gatewayConfig","fields":{"fallbackEnabled":{"name":"fallbackEnabled","type":"\u0004","is_mandatory":true,"title":"Whether traffic fallback to other served entities on failure is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"guardrails":{"name":"guardrails","type":"\n","is_mandatory":true,"title":"AI guardrail filters applied to endpoint inputs and outputs","provider":"go.mondoo.com/mql/providers/databricks"},"inferenceTableCatalog":{"name":"inferenceTableCatalog","type":"\u0007","is_mandatory":true,"title":"Unity Catalog catalog holding the inference table","provider":"go.mondoo.com/mql/providers/databricks"},"inferenceTableEnabled":{"name":"inferenceTableEnabled","type":"\u0004","is_mandatory":true,"title":"Whether inference-table payload logging is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"inferenceTableSchema":{"name":"inferenceTableSchema","type":"\u0007","is_mandatory":true,"title":"Unity Catalog schema holding the inference table","provider":"go.mondoo.com/mql/providers/databricks"},"inferenceTableTablePrefix":{"name":"inferenceTableTablePrefix","type":"\u0007","is_mandatory":true,"title":"Prefix of the inference table name in Unity Catalog","provider":"go.mondoo.com/mql/providers/databricks"},"rateLimits":{"name":"rateLimits","type":"\u0019\n","is_mandatory":true,"title":"Rate limits applied to the endpoint, each with calls, renewalPeriod, key, and principal","provider":"go.mondoo.com/mql/providers/databricks"},"usageTrackingEnabled":{"name":"usageTrackingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether operational usage tracking through system tables is enabled","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"AI Gateway configuration on a model serving endpoint","private":true,"min_provider_version":"13.0.1","defaults":"usageTrackingEnabled inferenceTableEnabled","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.servingEndpoint.servedEntity":{"id":"databricks.servingEndpoint.servedEntity","name":"databricks.servingEndpoint.servedEntity","fields":{"entityName":{"name":"entityName","type":"\u0007","is_mandatory":true,"title":"Name of the served Unity Catalog model or entity","provider":"go.mondoo.com/mql/providers/databricks"},"entityVersion":{"name":"entityVersion","type":"\u0007","is_mandatory":true,"title":"Version of the served entity","provider":"go.mondoo.com/mql/providers/databricks"},"externalModelName":{"name":"externalModelName","type":"\u0007","is_mandatory":true,"title":"Name of the served external model, empty when the entity is not an external model","provider":"go.mondoo.com/mql/providers/databricks"},"externalModelProvider":{"name":"externalModelProvider","type":"\u0007","is_mandatory":true,"title":"Provider of the served external model","desc":"One of ai21labs, amazon-bedrock, anthropic, cohere, custom, databricks-model-serving, google-cloud-vertex-ai, openai, or palm. Empty when the entity is not an external model.","provider":"go.mondoo.com/mql/providers/databricks"},"externalModelTask":{"name":"externalModelTask","type":"\u0007","is_mandatory":true,"title":"Task type of the served external model, empty when the entity is not an external model","provider":"go.mondoo.com/mql/providers/databricks"},"foundationModelName":{"name":"foundationModelName","type":"\u0007","is_mandatory":true,"title":"Name of the served Databricks foundation model, empty when the entity is not a foundation model","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Name of the served entity within the endpoint config","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Served entity behind a model serving endpoint","private":true,"min_provider_version":"13.0.1","defaults":"name entityName","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.storageConfiguration":{"id":"databricks.storageConfiguration","name":"databricks.storageConfiguration","fields":{"bucketName":{"name":"bucketName","type":"\u0007","is_mandatory":true,"title":"Name of the cloud storage bucket","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the configuration was created","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Configuration id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Configuration name","provider":"go.mondoo.com/mql/providers/databricks"},"roleArn":{"name":"roleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the role granting write access to the bucket","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Account storage configuration","desc":"A cloud storage bucket the account writes to, keyed by its configuration id. Workspace root storage and log delivery both target one of these, so the bucket named here is where workspace data or the account's audit record lands. Select a configuration by name, for example `databricks.storageConfigurations.where(name == \"audit-logs\")`.","min_provider_version":"13.1.4","defaults":"name bucketName","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.storageCredential":{"id":"databricks.storageCredential","name":"databricks.storageCredential","fields":{"awsIamRoleArn":{"name":"awsIamRoleArn","type":"\u0007","is_mandatory":true,"title":"ARN of the AWS IAM role the credential assumes","provider":"go.mondoo.com/mql/providers/databricks"},"awsIamRoleExternalId":{"name":"awsIamRoleExternalId","type":"\u0007","is_mandatory":true,"title":"External ID used when assuming the AWS IAM role, which guards against the confused-deputy problem","provider":"go.mondoo.com/mql/providers/databricks"},"azureAccessConnectorId":{"name":"azureAccessConnectorId","type":"\u0007","is_mandatory":true,"title":"Azure resource ID of the Databricks access connector for the managed identity","provider":"go.mondoo.com/mql/providers/databricks"},"azureServicePrincipalApplicationId":{"name":"azureServicePrincipalApplicationId","type":"\u0007","is_mandatory":true,"title":"Application ID of the Azure service principal the credential uses","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Credential comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the credential was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the credential","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name of the credential","provider":"go.mondoo.com/mql/providers/databricks"},"gcpServiceAccountEmail":{"name":"gcpServiceAccountEmail","type":"\u0007","is_mandatory":true,"title":"Email of the GCP service account the credential uses","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the credential","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the credential","provider":"go.mondoo.com/mql/providers/databricks"},"isolationMode":{"name":"isolationMode","type":"\u0007","is_mandatory":true,"title":"Isolation mode (ISOLATED or OPEN)","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the credential belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Credential name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the credential","provider":"go.mondoo.com/mql/providers/databricks"},"readOnly":{"name":"readOnly","type":"\u0004","is_mandatory":true,"title":"Whether the credential is usable only for read operations","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the credential was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the credential","provider":"go.mondoo.com/mql/providers/databricks"},"usedForManagedStorage":{"name":"usedForManagedStorage","type":"\u0004","is_mandatory":true,"title":"Whether the credential backs the metastore's root managed storage","provider":"go.mondoo.com/mql/providers/databricks"},"workspaceBindings":{"name":"workspaceBindings","type":"\u001a\u0007\u0007","title":"Workspaces the credential is bound to","desc":"Keyed by numeric workspace id, valued by the access the binding grants. Storage credentials only support BINDING_TYPE_READ_WRITE. Only meaningful when isolationMode is ISOLATED, which restricts the credential to the bound workspaces.","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog storage credential","desc":"A storage credential holds the cloud identity Unity Catalog assumes to reach external storage: an AWS IAM role, an Azure managed identity or service principal, or a GCP service account. Auditing storage credentials surfaces the vended principal (the AWS role ARN and its external ID, the Azure access connector, the Azure application ID, or the GCP service account email), the isolation mode that controls which workspaces can use it, whether it is read-only or backs the metastore's root managed storage, and the privilege grants assigned on it. Select a credential by name, for example `databricks.storageCredentials.where(name == \"prod-s3\")`.","min_provider_version":"13.0.1","defaults":"name owner isolationMode","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.systemSchema":{"id":"databricks.systemSchema","name":"databricks.systemSchema","fields":{"schema":{"name":"schema","type":"\u0007","is_mandatory":true,"title":"Schema name within the system catalog, such as access, billing, compute, or lakeflow","provider":"go.mondoo.com/mql/providers/databricks"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Whether the schema is enabled on the metastore","desc":"One of ENABLE_INITIALIZED, ENABLE_COMPLETED, DISABLE_INITIALIZED, UNAVAILABLE, or AVAILABLE. Only ENABLE_COMPLETED means the schema is populated and queryable.","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog system schema","desc":"A schema of the `system` catalog, which Databricks populates with operational data about the metastore, keyed by schema name. Each schema is enabled separately, so this reports which ones are turned on: `access` holds the audit log of workspace and Unity Catalog activity, `billing` holds usage and pricing, `compute` holds cluster and warehouse events, and `lakeflow` holds job run history. Select a schema by name, for example `databricks.systemSchemas.where(schema == \"access\")`.","min_provider_version":"13.1.4","defaults":"schema state","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.token":{"id":"databricks.token","name":"databricks.token","fields":{"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Comment describing the token","provider":"go.mondoo.com/mql/providers/databricks"},"createdByUsername":{"name":"createdByUsername","type":"\u0007","is_mandatory":true,"title":"Login name of the user that created the token","provider":"go.mondoo.com/mql/providers/databricks"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"Time the token was created","provider":"go.mondoo.com/mql/providers/databricks"},"expiryTime":{"name":"expiryTime","type":"\t","is_mandatory":true,"title":"Time the token expires, null when the token never expires","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Token id","provider":"go.mondoo.com/mql/providers/databricks"},"ownerId":{"name":"ownerId","type":"\u0005","is_mandatory":true,"title":"Numeric id of the user that owns the token","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks personal access token","desc":"A personal access token issued in the workspace, keyed by its token id. Covers the owning user, the creation and expiry times, and the comment set on the token. A token with no expiry never expires and is a standing credential. Select a token by id, for example `databricks.tokens.where(comment == \"ci\")`.","min_provider_version":"13.0.0","defaults":"comment createdByUsername expiryTime","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.user":{"id":"databricks.user","name":"databricks.user","fields":{"active":{"name":"active","type":"\u0004","is_mandatory":true,"title":"Whether the user account is active","provider":"go.mondoo.com/mql/providers/databricks"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/providers/databricks"},"emails":{"name":"emails","type":"\u0019\u0007","is_mandatory":true,"title":"Email addresses associated with the user","provider":"go.mondoo.com/mql/providers/databricks"},"entitlements":{"name":"entitlements","type":"\u0019\u0007","is_mandatory":true,"title":"Account-level entitlements granted to the user","provider":"go.mondoo.com/mql/providers/databricks"},"externalId":{"name":"externalId","type":"\u0007","is_mandatory":true,"title":"External identity provider id","provider":"go.mondoo.com/mql/providers/databricks"},"groups":{"name":"groups","type":"\u0019\u001bdatabricks.group","title":"Groups the user belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"SCIM id","provider":"go.mondoo.com/mql/providers/databricks"},"roles":{"name":"roles","type":"\u0019\u0007","is_mandatory":true,"title":"Cloud roles (such as AWS instance profile ARNs) granted to the user","provider":"go.mondoo.com/mql/providers/databricks"},"userName":{"name":"userName","type":"\u0007","is_mandatory":true,"title":"Login name (email)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks account user","desc":"A user account provisioned in the Databricks account through SCIM, keyed by userName (the login email). Covers the active state, account-level entitlements (such as allow-cluster-create or databricks-sql-access), the cloud roles granted to the user, and group memberships. Select a user by name, for example `databricks.users.where(userName == \"alice@example.com\")`.","min_provider_version":"13.0.0","defaults":"userName active","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.volume":{"id":"databricks.volume","name":"databricks.volume","fields":{"catalog":{"name":"catalog","type":"\u001bdatabricks.catalog","title":"Parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"catalogName":{"name":"catalogName","type":"\u0007","is_mandatory":true,"title":"Name of the parent catalog","provider":"go.mondoo.com/mql/providers/databricks"},"comment":{"name":"comment","type":"\u0007","is_mandatory":true,"title":"Volume comment","provider":"go.mondoo.com/mql/providers/databricks"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"When the volume was created","provider":"go.mondoo.com/mql/providers/databricks"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"User who created the volume","provider":"go.mondoo.com/mql/providers/databricks"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Fully qualified name (catalog.schema.volume)","provider":"go.mondoo.com/mql/providers/databricks"},"grants":{"name":"grants","type":"\u0019\u001bdatabricks.grant","title":"Privilege grants assigned directly on the volume","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the volume","provider":"go.mondoo.com/mql/providers/databricks"},"metastoreId":{"name":"metastoreId","type":"\u0007","is_mandatory":true,"title":"Id of the metastore the volume belongs to","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Volume name","provider":"go.mondoo.com/mql/providers/databricks"},"owner":{"name":"owner","type":"\u0007","is_mandatory":true,"title":"Principal that owns the volume","provider":"go.mondoo.com/mql/providers/databricks"},"schema":{"name":"schema","type":"\u001bdatabricks.schema","title":"Parent schema","provider":"go.mondoo.com/mql/providers/databricks"},"schemaName":{"name":"schemaName","type":"\u0007","is_mandatory":true,"title":"Name of the parent schema","provider":"go.mondoo.com/mql/providers/databricks"},"sseEncryptionAlgorithm":{"name":"sseEncryptionAlgorithm","type":"\u0007","is_mandatory":true,"title":"Server-side encryption algorithm applied to the storage path","desc":"One of AWS_SSE_S3 or AWS_SSE_KMS. Empty when no server-side encryption is recorded for the volume.","provider":"go.mondoo.com/mql/providers/databricks"},"sseKmsKeyArn":{"name":"sseKmsKeyArn","type":"\u0007","is_mandatory":true,"title":"ARN of the KMS key used for server-side encryption, when the algorithm is AWS_SSE_KMS","provider":"go.mondoo.com/mql/providers/databricks"},"storageLocation":{"name":"storageLocation","type":"\u0007","is_mandatory":true,"title":"Cloud storage path backing an external volume","provider":"go.mondoo.com/mql/providers/databricks"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"When the volume was last modified","provider":"go.mondoo.com/mql/providers/databricks"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"User who last modified the volume","provider":"go.mondoo.com/mql/providers/databricks"},"volumeType":{"name":"volumeType","type":"\u0007","is_mandatory":true,"title":"Volume type (EXTERNAL or MANAGED)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Unity Catalog volume","desc":"A Unity Catalog volume governs access to a directory of non-tabular data under a schema, keyed by its fully qualified name. Auditing volumes surfaces the volume type (EXTERNAL volumes live in a cloud storage path outside managed storage, MANAGED volumes live in the schema's default location), the storage location backing an external volume, the server-side encryption applied to it, the owner, and the privilege grants assigned on it. For example `databricks.catalogs.schemas.volumes.where(volumeType == \"EXTERNAL\")`.","min_provider_version":"13.0.1","defaults":"fullName volumeType owner","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.warehouse":{"id":"databricks.warehouse","name":"databricks.warehouse","fields":{"autoStopMinutes":{"name":"autoStopMinutes","type":"\u0005","is_mandatory":true,"title":"Minutes of inactivity before the warehouse stops, 0 when disabled","provider":"go.mondoo.com/mql/providers/databricks"},"channel":{"name":"channel","type":"\u0007","is_mandatory":true,"title":"Release channel (such as CHANNEL_NAME_CURRENT or CHANNEL_NAME_PREVIEW)","provider":"go.mondoo.com/mql/providers/databricks"},"clusterSize":{"name":"clusterSize","type":"\u0007","is_mandatory":true,"title":"T-shirt size of the warehouse clusters","provider":"go.mondoo.com/mql/providers/databricks"},"creatorName":{"name":"creatorName","type":"\u0007","is_mandatory":true,"title":"Login name of the user that created the warehouse","provider":"go.mondoo.com/mql/providers/databricks"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Warehouse id","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Warehouse name","provider":"go.mondoo.com/mql/providers/databricks"},"permissions":{"name":"permissions","type":"\u0019\u001bdatabricks.permission","title":"Workspace access control list of the warehouse","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"photonEnabled":{"name":"photonEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the Photon query engine is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"serverlessEnabled":{"name":"serverlessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether serverless compute is enabled","provider":"go.mondoo.com/mql/providers/databricks"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Current state (such as RUNNING or STOPPED)","provider":"go.mondoo.com/mql/providers/databricks"},"warehouseType":{"name":"warehouseType","type":"\u0007","is_mandatory":true,"title":"Warehouse type (CLASSIC, PRO, or TYPE_UNSPECIFIED)","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks SQL warehouse","desc":"A SQL warehouse in the workspace, keyed by name. Covers the warehouse type, whether Photon and serverless compute are enabled, the release channel, and the current state. Select a warehouse by name, for example `databricks.warehouses.where(name == \"bi\")`.","min_provider_version":"13.0.0","defaults":"name warehouseType state","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.workspace":{"id":"databricks.workspace","name":"databricks.workspace","fields":{"awsRegion":{"name":"awsRegion","type":"\u0007","is_mandatory":true,"title":"AWS region hosting the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"cloud":{"name":"cloud","type":"\u0007","is_mandatory":true,"title":"Hosting cloud (aws, azure, or gcp)","provider":"go.mondoo.com/mql/providers/databricks"},"creationTime":{"name":"creationTime","type":"\t","is_mandatory":true,"title":"Time the workspace was created","provider":"go.mondoo.com/mql/providers/databricks"},"customTags":{"name":"customTags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom tags applied to the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"deploymentName":{"name":"deploymentName","type":"\u0007","is_mandatory":true,"title":"Deployment name (the workspace URL subdomain)","provider":"go.mondoo.com/mql/providers/databricks"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"GCP or Azure location hosting the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"managedServicesCustomerManagedKey":{"name":"managedServicesCustomerManagedKey","type":"\u001bdatabricks.customerManagedKey","title":"Customer-managed key protecting control-plane managed services, null when using Databricks-managed keys","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workspace name","provider":"go.mondoo.com/mql/providers/databricks"},"network":{"name":"network","type":"\u001bdatabricks.network","title":"Customer-managed network isolating the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"permissionAssignments":{"name":"permissionAssignments","type":"\u0019\u001bdatabricks.workspaceAssignment","title":"Principals granted access to the workspace, and at what level","min_provider_version":"13.1.4","provider":"go.mondoo.com/mql/providers/databricks"},"pricingTier":{"name":"pricingTier","type":"\u0007","is_mandatory":true,"title":"Pricing tier","desc":"One of COMMUNITY_EDITION, DEDICATED, ENTERPRISE, PREMIUM, STANDARD, or UNKNOWN.","provider":"go.mondoo.com/mql/providers/databricks"},"privateAccessSettings":{"name":"privateAccessSettings","type":"\u001bdatabricks.privateAccessSetting","title":"Private access settings applied to the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Provisioning status","desc":"One of BANNED, CANCELLING, FAILED, NOT_PROVISIONED, PROVISIONING, or RUNNING.","provider":"go.mondoo.com/mql/providers/databricks"},"statusMessage":{"name":"statusMessage","type":"\u0007","is_mandatory":true,"title":"Human-readable detail for the current status","provider":"go.mondoo.com/mql/providers/databricks"},"storageCustomerManagedKey":{"name":"storageCustomerManagedKey","type":"\u001bdatabricks.customerManagedKey","title":"Customer-managed key protecting workspace storage, null when using Databricks-managed keys","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"workspaceId":{"name":"workspaceId","type":"\u0005","is_mandatory":true,"title":"Numeric workspace id","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks workspace","desc":"A workspace registered in the Databricks account, keyed by the numeric workspaceId. Covers the deployment name, provisioning status, pricing tier, hosting cloud and region, the customer-managed keys protecting managed services and storage, and the network and private access settings that isolate the workspace. Select a workspace by id, for example `databricks.workspaces.where(workspaceId == 123456789)`.","min_provider_version":"13.0.0","defaults":"name workspaceId cloud","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.workspaceAssignment":{"id":"databricks.workspaceAssignment","name":"databricks.workspaceAssignment","fields":{"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the principal","provider":"go.mondoo.com/mql/providers/databricks"},"permissions":{"name":"permissions","type":"\u0019\u0007","is_mandatory":true,"title":"Access levels granted on the workspace","desc":"USER grants access to the workspace, ADMIN additionally grants workspace administration. UNKNOWN appears when the API reports a level this SDK version does not model.","provider":"go.mondoo.com/mql/providers/databricks"},"principal":{"name":"principal","type":"\u0007","is_mandatory":true,"title":"Name of the principal the access is assigned to","provider":"go.mondoo.com/mql/providers/databricks"},"principalId":{"name":"principalId","type":"\u0005","is_mandatory":true,"title":"Numeric id of the principal","provider":"go.mondoo.com/mql/providers/databricks"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Kind of principal, USER, GROUP, or SERVICE_PRINCIPAL","provider":"go.mondoo.com/mql/providers/databricks"},"workspaceId":{"name":"workspaceId","type":"\u0005","is_mandatory":true,"title":"Numeric id of the workspace the assignment applies to","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Workspace access assignment","desc":"A principal's access to a single workspace, assigned at the account level rather than inside the workspace. Covers who the principal is and whether they hold workspace admin. Account-level assignment is how a principal reaches a workspace at all, so a principal absent here has no access to it regardless of any in-workspace grant.","min_provider_version":"13.1.4","defaults":"principal principalType permissions","provider":"go.mondoo.com/mql/providers/databricks"},"databricks.workspaceConf":{"id":"databricks.workspaceConf","name":"databricks.workspaceConf","fields":{"automaticClusterUpdateEnabled":{"name":"automaticClusterUpdateEnabled","type":"\u0004","title":"Whether automatic cluster update is enabled, auto-restarting clusters to apply security updates","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"complianceSecurityProfileEnabled":{"name":"complianceSecurityProfileEnabled","type":"\u0004","title":"Whether the compliance security profile is enabled on the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"complianceSecurityStandards":{"name":"complianceSecurityStandards","type":"\u0019\u0007","title":"Compliance standards selected for the compliance security profile","desc":"Each entry is a standard such as HIPAA, PCI_DSS, FEDRAMP_MODERATE, FEDRAMP_HIGH, FEDRAMP_IL5, IRAP_PROTECTED, CANADA_PROTECTED_B, GERMANY_C5, GERMANY_TISAX, HITRUST, ISMAP, ITAR_EAR, K_FSI, or CYBER_ESSENTIAL_PLUS. Empty when the compliance security profile is not enabled.","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"deprecatedClusterNamedInitScriptsEnabled":{"name":"deprecatedClusterNamedInitScriptsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether legacy cluster-named init scripts are enabled","provider":"go.mondoo.com/mql/providers/databricks"},"deprecatedGlobalInitScriptsEnabled":{"name":"deprecatedGlobalInitScriptsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether legacy global init scripts are enabled","provider":"go.mondoo.com/mql/providers/databricks"},"disableLegacyAccess":{"name":"disableLegacyAccess","type":"\u0004","title":"Whether legacy access to the workspace is disabled","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"enhancedSecurityMonitoringEnabled":{"name":"enhancedSecurityMonitoringEnabled","type":"\u0004","title":"Whether enhanced security monitoring is enabled on the workspace","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"ipAccessListsEnabled":{"name":"ipAccessListsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether IP access lists are enforced for the workspace","provider":"go.mondoo.com/mql/providers/databricks"},"maxTokenLifetimeDays":{"name":"maxTokenLifetimeDays","type":"\u0005","is_mandatory":true,"title":"Maximum lifetime in days for newly created personal access tokens","provider":"go.mondoo.com/mql/providers/databricks"},"restrictWorkspaceAdminsStatus":{"name":"restrictWorkspaceAdminsStatus","type":"\u0007","title":"Workspace admin restriction status","desc":"One of ALLOW_ALL or RESTRICT_TOKENS_AND_JOB_RUN_AS. RESTRICT_TOKENS_AND_JOB_RUN_AS limits what workspace admins may do with personal access tokens and job run-as identities.","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/providers/databricks"},"storeInteractiveNotebookResultsInCustomerAccount":{"name":"storeInteractiveNotebookResultsInCustomerAccount","type":"\u0004","is_mandatory":true,"title":"Whether interactive notebook results are stored in the customer's account","provider":"go.mondoo.com/mql/providers/databricks"},"tokensEnabled":{"name":"tokensEnabled","type":"\u0004","is_mandatory":true,"title":"Whether personal access tokens may be created in the workspace","provider":"go.mondoo.com/mql/providers/databricks"}},"title":"Databricks workspace security settings","desc":"Security-relevant workspace configuration read from the workspace conf, such as whether personal access tokens are permitted, the maximum token lifetime, whether IP access lists are enforced, and whether legacy global init scripts are enabled. A field is null when the corresponding conf key is unset.","min_provider_version":"13.0.0","defaults":"tokensEnabled ipAccessListsEnabled","provider":"go.mondoo.com/mql/providers/databricks"}}}