Databricks

Databricks is a unified data lakehouse platform that provides data engineering, data science, machine learning, and analytics capabilities. It exposes a SQL Statement Execution REST API for querying data via SQL over HTTP, Unity Catalog APIs for metadata discovery, and workspace management APIs for compute, jobs, pipelines, identity, and audit operations.

Overview
Setup Guide
Permissions
Troubleshooting

Connect Parable to Databricks using a service principal and the OAuth 2.0 client credentials flow. Parable uses the workspace REST APIs for the metadata and identity data streams. It uses the SQL Statement Execution API for the user-activity data streams (audit_logs, query_history) against Unity Catalog system tables.This integration uses OAuth 2.0 Client Credentials flow for server-to-server authentication.

How It Works

Parable exchanges the Client ID and Client Secret for a short-lived access token and gets a new token when it expires.

Token Request

cURL

curl -X POST "https://&lt;workspace-host&gt;/oidc/v1/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

Python

response = requests.post(
    "https://&lt;workspace-host&gt;/oidc/v1/token",
    data={
        "grant_type": "client_credentials",
        "client_id": "YOUR_CLIENT_ID",
        "client_secret": "YOUR_CLIENT_SECRET"
    }
)

access_token = response.json()["access_token"]
print(f"Access Token: {access_token}")

Using the Access Token

Authorization: Bearer {access_token}

Info: Parable automatically handles token refresh, so you don’t need to manage token expiration manually.

Metadata & identity

Unity Catalog catalogs, schemas, tables; SCIM users and groups

User activity

Audit events and SQL query history from system.access.audit and system.query.history

Data stream	Source	Enabled by default
`users`, `groups`, `group_members`	SCIM API	Yes
`catalogs`, `schemas`, `tables`	Unity Catalog API	Yes
`audit_logs`	`system.access.audit`	Yes
`query_history`	`system.query.history`	Yes
`jobs`, `job_runs`, `clusters`, `pipelines`, etc.	Workspace APIs	Opt-in

Data streams

This Provider Plugin defines 15 data streams.

Stream	Description	Sync
`catalogs`	Lists all Unity Catalog catalogs available in the Databricks workspace. Provides metadata about each catalog including name, owner, comment, and properties.	full
`schemas`	Lists all schemas within a specified Unity Catalog catalog. Provides schema metadata including name, owner, and properties.	full
`tables`	Lists all tables within a specified Unity Catalog catalog and schema. Provides table metadata including columns, data types, and storage info.	full
`table_summaries`	Lists table summaries within a catalog, providing a lightweight view of available tables with optional LIKE pattern filtering.	full
`clusters`	Lists all clusters in the Databricks workspace. Provides compute cluster metadata including configuration, state, and resource allocation details.	full
`sql_warehouses`	Lists all SQL warehouses in the Databricks workspace. Provides SQL warehouse configuration, state, and sizing details.	full
`jobs`	Lists all jobs defined in the Databricks workspace. Provides job configuration, schedule, and metadata.	full
`job_runs`	Lists job runs in the Databricks workspace. Provides run execution details including status, duration, and task results.	full
`pipelines`	Lists all Delta Live Tables (DLT) pipelines in the Databricks workspace. Provides pipeline configuration, state, and metadata.	full
`users`	Lists all users in the Databricks workspace via the SCIM v2 API. Provides user identity, email, and group membership information.	full
`groups`	Lists all groups in the Databricks workspace via the SCIM v2 API. Provides group membership and role information.	full
`group_members`	Lists the members of each Databricks workspace group via the SCIM v2 API: one record for each user, service principal or nested group in each group.	full
`service_principals`	Lists all service principals in the Databricks workspace via the SCIM v2 API. Provides service principal identity and entitlement information.	full
`audit_logs`	Human workspace audit events from system.access.audit (Unity Catalog). Keeps rows with a real user email and drops service-principal / System-User firehose plus token-login, Unity Catalog internals, filesystem signed-URL churn, secrets polling, and lineage/optimization noise. Queried via the SQL Statement Execution API. Requires USE CATALOG on system, USE SCHEMA on system.access, and SELECT on system.access.audit.	incremental
`query_history`	SQL and serverless compute query execution history from system.query.history. Includes executor identity, statement text, timing, client application, and query_source linkage to notebooks, jobs, and dashboards. Queried via the SQL Statement Execution API. Requires USE CATALOG on system, USE SCHEMA on system.query, and SELECT on system.query.history.	incremental

Source permissions

Databricks shows a Unity Catalog object to its owner and to the principals that hold a grant on it. A job, a pipeline, a cluster and a SQL warehouse open to the principals on their access control list, and the creator is the owner by default. When source permissions apply, Parable follows the owners and the actors. It does not read grants or access control lists yet (Source permissions):

Stream	Who reads a record
Catalogs, Schemas, Tables	The owner: the user, or each member of the group, that `owner` names. A member of a nested group counts as a member.
Table Summaries	The readers of the table in Tables.
Jobs, Pipelines, Clusters, SQL Warehouses	The user who created it.
Job Runs	The readers of the run’s job.
Query History	The user who ran the statement.
Audit Logs	The user who performed the action.
Users, Groups, Group Members, Service Principals	Only people with All data access.

Parable matches a member of your Workspace to their Databricks user by the user’s userName, which is the user’s email. Only a user whose active is true reads through that account. An inactive user, or a user whose active value Databricks does not return, reads nothing, and their group memberships count for nothing. A user, a group or a membership that a later sync does not return is marked deleted, so its access ends at that sync. A service principal is never a reader, so a query it ran opens to All data access only.A principal that holds only a grant, such as SELECT or CAN VIEW, reads nothing through it in Parable yet. Workspace admins read every workspace object in Databricks. To let a role in your Workspace read these streams in Parable, give the role All data access, or add a Provider Policy rule that gives the role All rows on each stream.

What You’ll Need

Credential	What it is
Client ID	Service principal application (client) ID
Client Secret	OAuth secret generated for the service principal
Workspace hostname	Workspace URL host only (no `https://`)
SQL warehouse ID	Warehouse used for SQL Statement Execution API calls
Token endpoint	Account- or workspace-level OAuth token URL

Info: Setup access in Databricks. These steps require Account admin or workspace admin, or a colleague with equivalent permissions who can create credentials for you. If that is not you, ask your Databricks administrator.

A Databricks workspace on AWS, Azure, or GCP with Unity Catalog enabled
At least one SQL warehouse (running or auto-start enabled)
System tables enabled for the account (Enable system tables)
Network access from Parable to the workspace hostname

Step 1: Create a service principal

Open the Databricks Account Console:
- AWS: accounts.cloud.databricks.com
- Azure: accounts.azuredatabricks.net
- GCP: accounts.gcp.databricks.com
Go to User management → Service principals.
Click Add service principal (for example, parable-integration).
Copy the Application (client) ID.

Step 2: Assign the service principal to the workspace

In the Account Console, open the service principal → Workspaces tab.
Add the target workspace.
Set permission level to User (recommended starting point).

Parable reads users and groups through the workspace SCIM API. If connection tests return 403 on the identity data streams, change this assignment to Admin for this workspace only. Do not grant account admin on the service principal.

Step 3: Generate an OAuth secret

Open the service principal in the Account Console.
Go to OAuth secrets.
Click Generate secret.
Copy the Client secret immediately — it is shown only once.

Save both the Client ID and Client secret for the Parable connection form.

Step 4: Grant SQL warehouse access

In the workspace, open SQL → SQL warehouses.
Select the warehouse Parable will use.
Open Permissions.
Grant the service principal CAN USE on the warehouse.

Step 5: Grant Unity Catalog metadata access

Parable lists catalog, schema, and table metadata only. Grant BROWSE on each catalog Parable should inventory. This allows discovery via the Unity Catalog API without read access to table data.Run as a metastore admin or account admin from a Unity Catalog-enabled workspace SQL editor. Replace `<service-principal-name>` with the service principal display name (for example, `parable-integration`):

GRANT BROWSE ON CATALOG main TO `<service-principal-name>`;
GRANT BROWSE ON CATALOG analytics TO `<service-principal-name>`;

Repeat for each catalog you want Parable to scan. Do not grant SELECT, MODIFY, MANAGE, or ALL PRIVILEGES on customer tables unless you have a separate requirement.Catalogs bound only to other workspaces are not visible from this workspace even with BROWSE. See Unity Catalog privileges.

Step 6: Grant system table access (user activity data streams)

Required for audit_logs and query_history. Run from a Unity Catalog-enabled workspace as a metastore admin or account admin:

GRANT USE CATALOG ON CATALOG system TO `<service-principal-name>`;
GRANT USE SCHEMA ON SCHEMA system.access TO `<service-principal-name>`;
GRANT SELECT ON TABLE system.access.audit TO `<service-principal-name>`;
GRANT USE SCHEMA ON SCHEMA system.query TO `<service-principal-name>`;
GRANT SELECT ON TABLE system.query.history TO `<service-principal-name>`;

See Grant access to system tables.

Step 7: Enter values in Parable

Field	Value
Client ID (`clientId`)	Service principal application ID
Client secret (`clientSecret`)	OAuth secret from the previous step
Token endpoint (`tokenEndpoint`)	Full HTTPS OAuth token URL (see examples below)
Workspace instance (`workspace_instance`)	Hostname only, e.g. `dbc-abc123.cloud.databricks.com`
SQL warehouse ID (`warehouse_id`)	From SQL warehouse Connection details
Account ID (`account_id`)	Optional; required for account-level OAuth token URLs
Cloud provider (`cloud_provider`)	Optional; `aws`, `azure`, or `gcp` — used with account-level OAuth
Activity workspace ID (`activity_workspace_id`)	Optional numeric filter for the activity data streams. Leave it blank for all workspaces in the region.

Token endpoint is the URL Parable POSTs to for OAuth tokens. Paste the full URL, not just the workspace hostname.Workspace-level (most common — same host as workspace instance):

https://dbc-abc123.cloud.databricks.com/oidc/v1/token

Pattern: https://<workspace-hostname>/oidc/v1/tokenAccount-level (multi-workspace; replace <account-id>):

Cloud	Token endpoint
AWS	`https://accounts.cloud.databricks.com/oidc/accounts/<account-id>/v1/token`
Azure	`https://accounts.azuredatabricks.net/oidc/accounts/<account-id>/v1/token`
GCP	`https://accounts.gcp.databricks.com/oidc/accounts/<account-id>/v1/token`

OAuth scope: all-apis (configured on the Provider; you do not enter it separately).

Step 8: Test connection

Parable verifies connectivity by executing a SQL statement against the configured warehouse (for example, SELECT 1 via /api/2.0/sql/statements).

Success: If you received a 200 OK response with valid data, your credentials are configured correctly. You can now configure this Provider in Parable.

Tip: Rate Limits: Databricks rate limits vary by endpoint. By default, Parable sends 2–10 requests per second, depending on the data stream. Parable waits and tries again when Databricks limits requests, so the first sync of a large dataset can take longer.

Databricks

Parable uses the OAuth scope all-apis for service principal authentication. That scope is coarse: it allows the service principal to call Databricks REST APIs for which it has been granted permission in the workspace and Unity Catalog. Least privilege is enforced with workspace roles, SQL warehouse permissions, and Unity Catalog grants — not with a finer OAuth scope.

Permission layers

Layer	Where to configure	What Parable needs
Account	Account Console → Service principals	Dedicated SP, OAuth secret, workspace assignment
Workspace	Workspace permissions + SQL warehouses	User (or Admin if SCIM returns 403); CAN USE on one SQL warehouse
Unity Catalog	SQL grants or Catalog Explorer	`BROWSE` on named customer catalogs; read-only grants on `system` tables

Do not grant account admin, metastore admin, or CAN MANAGE on the SQL warehouse.

Grants by default data stream

Data stream	Permission
`audit_logs`	CAN USE on SQL warehouse + `SELECT` on `system.access.audit`
`query_history`	CAN USE on SQL warehouse + `SELECT` on `system.query.history`
`catalogs`, `schemas`, `tables`	`BROWSE` on each target customer catalog
`users`, `groups`, `group_members`	Workspace User; Admin on this workspace if SCIM list returns 403

System table grants (reference)

GRANT USE CATALOG ON CATALOG system TO `<service-principal-name>`;
GRANT USE SCHEMA ON SCHEMA system.access TO `<service-principal-name>`;
GRANT SELECT ON TABLE system.access.audit TO `<service-principal-name>`;
GRANT USE SCHEMA ON SCHEMA system.query TO `<service-principal-name>`;
GRANT SELECT ON TABLE system.query.history TO `<service-principal-name>`;

Verify permissions

After generating an OAuth token for the service principal, run these checks (replace placeholders):

TOKEN=<access-token>
HOST=https://<workspace-host>
WAREHOUSE_ID=<sql-warehouse-id>

cURL SQL warehouse

curl -s -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"statement\":\"SELECT 1\",\"warehouse_id\":\"$WAREHOUSE_ID\"}" \
  "$HOST/api/2.0/sql/statements"

cURL Unity Catalog

curl -s -H "Authorization: Bearer $TOKEN" \
  "$HOST/api/2.1/unity-catalog/catalogs?include_browse=true"

cURL SCIM

curl -s -H "Authorization: Bearer $TOKEN" \
  "$HOST/api/2.0/preview/scim/v2/Users?count=1"

A 403 on the SCIM call means the service principal needs Admin on this workspace, or you should disable the identity data streams in Parable.

Large workspace notes (`tables` data stream)

The tables data stream reads every catalog and schema. In large Unity Catalog estates the first sync can take 15-30+ minutes and produce tens of thousands of table metadata rows (several GB of data). This is expected: Parable reads the Unity Catalog API one page at a time and stores one row per table.

First sync: allow a longer sync window; disable tables initially if you only need catalogs/schemas.
Ongoing syncs: full refresh re-lists table metadata; row counts track catalog growth.
Deadlines: if the first tables sync exceeds its time limit, keep the tables data stream disabled until a maintenance window.

Security review notes

SCIM and workspace Admin (by design): Parable recommends starting with workspace User. If SCIM list calls return 403, the supported escalation is Admin on this workspace only, so the users, groups and group_members data streams can sync. Alternatively, leave the service principal at User and disable those identity data streams in Parable if you do not need them.
all-apis is not full admin. The service principal can only access APIs and data allowed by workspace and Unity Catalog grants.
Customer table data: BROWSE exposes metadata (names, comments, structure), not row contents. The activity data streams read platform audit and SQL history tables, not arbitrary customer tables.
No write path: The grants above do not allow modifying data, jobs, clusters, or permissions.

Audit Logs

Developer identifier: audit_logsAudit Logs covers human workspace audit events from system.access.audit (Unity Catalog). Keeps rows with a real user email and drops service-principal / System-User firehose plus token-login, Unity Catalog internals, filesystem signed-URL churn, secrets polling, and lineage/optimization noise. Queried via the SQL Statement Execution API. Requires USE CATALOG on system, USE SCHEMA on system.access, and SELECT on system.access.audit.

Enables: reconstruct an Audit Logs timeline and correlate each returned actor, target, action, and timestamp during an investigation. With source permissions on, a reader reads only the events that they performed (user_email).
Scope: Human workspace audit events from system.access.audit (Unity Catalog). Keeps rows with a real user email and drops service-principal / System-User firehose plus token-login, Unity Catalog internals, filesystem signed-URL churn, secrets polling, and lineage/optimization noise. Queried via the SQL Statement Execution API. Requires USE CATALOG on system, USE SCHEMA on system.access, and SELECT on system.access.audit; Parable reads the new records from /api/2.0/sql/statements on each sync, and each row is one event. The configured credential must grant the declared all-apis access scope; records outside that access are not returned. This stream has no deletion signal, so a missing row does not establish that the Databricks record was deleted.

Account ID

Developer identifier: audit_logs.account_idAccount ID records Databricks account ID. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate account_id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Action Name

Developer identifier: audit_logs.action_nameAction Name records action performed (e.g. login, runNow, commandSubmit). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Audit Logs investigation evidence with the exact action_name result, permission, or Databricks classification being examined.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Databricks-returned labels rather than a universal taxonomy.

Audit Level

Developer identifier: audit_logs.audit_levelAudit Level records WORKSPACE_LEVEL or ACCOUNT_LEVEL. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate audit_level with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Event Date

Developer identifier: audit_logs.event_dateEvent Date records calendar date of the event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate event_date with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; the schema uses the Temporal.Date scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Event ID

Developer identifier: audit_logs.event_idEvent ID records unique identifier for the audit event. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate event_id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is an identifier, not a measured quantity; it is the record key; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Event Time

Developer identifier: audit_logs.event_timeEvent Time records UTC timestamp when the event occurred. Parable uses it to find the records that are new or changed since the previous sync. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate event_time with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; Parable uses it to keep the latest version of each record; Parable treats it as the record’s event time; the schema uses the Temporal.DateTime scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Identity Metadata

Developer identifier: audit_logs.identity_metadataIdentity Metadata records run-as and run-by identity metadata for impersonation scenarios. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate identity_metadata with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is one nested object per containing Databricks Audit Log Event object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; keys and availability follow this Databricks response and may vary by object type or Databricks configuration.

Run As

Developer identifier: audit_logs.identity_metadata.run_asRun As records principal whose privileges were used. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate run_as with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Identity Metadata object returned for Audit Logs; it is interpreted at one Databricks Audit Identity Metadata record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Run By

Developer identifier: audit_logs.identity_metadata.run_byRun By records principal that initiated the action. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate run_by with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Identity Metadata object returned for Audit Logs; it is interpreted at one Databricks Audit Identity Metadata record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Request ID

Developer identifier: audit_logs.request_idRequest ID records unique request identifier. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate request_id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Request Params

Developer identifier: audit_logs.request_paramsRequest Params records action-specific request parameters. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate request_params with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; the schema uses the Generic.JSON scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Response

Developer identifier: audit_logs.responseResponse records HTTP response metadata for the audited action (JSON string under the JSON_ARRAY result format). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate response with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; the schema uses the Generic.JSON scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Service Name

Developer identifier: audit_logs.service_nameService Name records service that handled the request (e.g. notebook, jobs, accounts). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate service_name with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Session ID

Developer identifier: audit_logs.session_idSession ID records session ID associated with the request. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate session_id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Source IP Address

Developer identifier: audit_logs.source_ip_addressSource IP Address records source IP address of the request. It is needed to preserve the Databricks-reported network address context for the same record.

Enables: correlate source_ip_address with the actor, request, or session on the same Databricks event without treating it as proof of physical presence.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; the schema uses the Network.IpAddress scalar; the value is network address context; this Databricks-reported or configured context does not establish residency or verified physical presence; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Databricks-returned labels rather than a universal taxonomy.

User Agent

Developer identifier: audit_logs.user_agentUser Agent records user agent string from the request. It is needed to preserve the Databricks-reported client device or software context for the same record.

Enables: correlate user_agent with the actor, request, or session on the same Databricks event without treating it as proof of physical presence.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; the value is client device or software context; this Databricks-reported or configured context does not establish residency or verified physical presence; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

User Email

Developer identifier: audit_logs.user_emailUser Email. The email address of the user who performed the action, as system.access.audit reports it in user_identity.email.

Enables: filter and group audit events by the acting user without parsing user_identity. For source permissions, only this user reads the event.
Interpretation: Databricks reports the actor’s email inside the user_identity struct; Parable selects it as its own column. The statement keeps only events whose actor email holds an @.

User Identity

Developer identifier: audit_logs.user_identityUser Identity records identity of the user who initiated the request (JSON string under the JSON_ARRAY result format). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate user_identity with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; the schema uses the Generic.JSON scalar; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Version

Developer identifier: audit_logs.versionVersion records audit log schema version. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate version with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is interpreted at one Databricks Audit Log Event record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Workspace ID

Developer identifier: audit_logs.workspace_idWorkspace ID records workspace ID where the event occurred. Account-level events use 0. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate workspace_id with the returned actor, target, action, request, or session identifiers on the same Audit Logs evidence record.
Interpretation: Databricks reports this value on the Databricks Audit Log Event object returned for Audit Logs; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Catalogs

Developer identifier: catalogsCatalogs covers Unity Catalog catalogs available in the Databricks workspace. Provides metadata about each catalog including name, owner, comment, and properties.

Enables: inventory returned Unity Catalog catalogs and compare their owner, catalog kind, storage reference, and browse-only or Workspace-access flags. With source permissions on, a reader reads a catalog that they own, or that a group they belong to owns.
Scope: Lists all Unity Catalog catalogs available in the Databricks workspace. Provides metadata about each catalog including name, owner, comment, and properties; Parable reads every record from /api/2.1/unity-catalog/catalogs on each sync. The configured credential must grant the declared all-apis access scope; records outside that access are not returned. This stream has no deletion signal, so a missing row does not establish that the Databricks record was deleted.

Accessible In Current Workspace

Developer identifier: catalogs.accessible_in_current_workspaceAccessible In Current Workspace records whether the catalog is accessible in the current workspace context. It is needed to distinguish Catalogs rows by the exact Databricks-returned accessible in current workspace value.

Enables: select Catalogs rows where accessible_in_current_workspace is true or false when comparing the condition described by Accessible In Current Workspace.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Browse Only

Developer identifier: catalogs.browse_onlyBrowse Only records whether the catalog is browse-only (no data access, metadata only). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Catalogs rows with the exact browse_only access-related value being investigated.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Databricks-returned labels rather than a universal taxonomy.

Cache Version Info

Developer identifier: catalogs.cache_version_infoCache Version Info records cache version metadata for the catalog. It is needed to inspect the exact metadata included with this record.

Enables: inspect the exact metadata keys returned in cache_version_info and associate them with the containing Catalogs record.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is one nested object per containing Catalog object when present; keys and availability follow this Databricks response and may vary by object type or Databricks configuration.

Metastore Version

Developer identifier: catalogs.cache_version_info.metastore_versionMetastore Version records metastore version cached for this catalog. It is needed to compare the exact metastore version configuration returned for this Cache Version Info record.

Enables: compare the exact metastore_version configuration returned for each Cache Version Info record and select records with the configuration under review.
Interpretation: Databricks reports this value on the Cache Version Info object returned for Catalogs; it is interpreted at one Cache Version Info record per row.

Catalog Type

Developer identifier: catalogs.catalog_typeCatalog Type records type of catalog (e.g., MANAGED_CATALOG, DELTASHARING_CATALOG). It is needed to distinguish Catalogs rows by the exact Databricks-returned catalog type value.

Enables: separate Catalogs rows by the exact Databricks-returned catalog_type label when comparing catalog type.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Comment

Developer identifier: catalogs.commentComment records comment or description for the catalog. It is needed to inspect the exact comment or journal text included with this record.

Enables: inspect the comment or journal text returned in comment and attribute it to the same record’s parent record, owner, status, and update time where returned.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is comment or journal text at one Catalog record per row; this is only the content included in the Databricks response for this record.

Connection Name

Developer identifier: catalogs.connection_nameConnection Name records name of the connection, applicable for foreign catalogs. It is needed to compare the returned connection name for individual Catalogs rows and select rows with a specific connection_name value.

Enables: locate Catalogs rows whose returned connection name exactly matches connection_name and retain the Databricks identifier for any cross-record match.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Created At

Developer identifier: catalogs.created_atCreated At records timestamp when the catalog was created, in epoch milliseconds. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Catalogs records by created_at, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; its unit or granularity is epoch milliseconds; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar.

Created By

Developer identifier: catalogs.created_byCreated By records user or principal who created the catalog. It is needed to attribute this Catalogs row to the returned person, account, or organization reference.

Enables: attribute the Catalogs row to the returned person or account and match the exact created_by value where it recurs in Databricks.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Effective Predictive Optimization Flag

Developer identifier: catalogs.effective_predictive_optimization_flagEffective Predictive Optimization Flag records effective predictive optimization flag details including value and source. It is needed to preserve the nested effective predictive optimization flag relationship or details on the parent Catalog record.

Enables: expand effective_predictive_optimization_flag to connect the containing Catalog row to its returned effective predictive optimization flag entries.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is one nested object per containing Catalog object when present.

Inherited From Name

Developer identifier: catalogs.effective_predictive_optimization_flag.inherited_from_nameInherited From Name records the name of the object from which this flag was inherited. It is needed to compare the returned inherited from name for individual Catalogs rows and select rows with a specific inherited_from_name value.

Enables: locate Catalogs rows whose returned inherited from name exactly matches inherited_from_name and retain the Databricks identifier for any cross-record match.
Interpretation: Databricks reports this value on the Effective Predictive Optimization Flag object returned for Catalogs; it is interpreted at one Effective Predictive Optimization Flag record per row.

Inherited From Type

Developer identifier: catalogs.effective_predictive_optimization_flag.inherited_from_typeInherited From Type records the type of object from which this flag was inherited (e.g., CATALOG, SCHEMA, ACCOUNT). It is needed to distinguish Catalogs rows by the exact Databricks-returned inherited from type value.

Enables: separate Catalogs rows by the exact Databricks-returned inherited_from_type label when comparing inherited from type.
Interpretation: Databricks reports this value on the Effective Predictive Optimization Flag object returned for Catalogs; it is interpreted at one Effective Predictive Optimization Flag record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Value

Developer identifier: catalogs.effective_predictive_optimization_flag.valueValue records the resolved effective value of predictive optimization. It is needed to distinguish Catalogs rows by the exact Databricks-returned value value.

Enables: separate Catalogs rows by the exact Databricks-returned value label when comparing value.
Interpretation: Databricks reports this value on the Effective Predictive Optimization Flag object returned for Catalogs; it is interpreted at one Effective Predictive Optimization Flag record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Enable Predictive Optimization

Developer identifier: catalogs.enable_predictive_optimizationEnable Predictive Optimization records whether predictive optimization is enabled for the catalog. It is needed to distinguish Catalogs rows by the exact Databricks-returned enable predictive optimization value.

Enables: select Catalogs rows where enable_predictive_optimization is true or false when comparing the condition described by Enable Predictive Optimization.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

ETag

Developer identifier: catalogs.etagETag records entity tag for optimistic concurrency on catalog updates. It is needed to compare the returned e tag for individual Catalogs rows and select rows with a specific etag value.

Enables: trace the e tag relationship returned in etag from the Catalog row to its named Databricks context.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Full Name

Developer identifier: catalogs.full_nameFull Name records full name of the catalog, typically the same as name for top-level catalogs. It is needed to compare the returned full name for individual Catalogs rows and select rows with a specific full_name value.

Enables: locate Catalogs rows whose returned full name exactly matches full_name and retain the Databricks identifier for any cross-record match.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Developer identifier: catalogs.idID records Unity Catalog catalog UUID. It is needed to refer to the same catalog across records without relying on display text.

Enables: match id to catalog references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is an identifier, not a measured quantity; the schema uses the Identity.UUID scalar.

Isolation Mode

Developer identifier: catalogs.isolation_modeIsolation Mode records isolation mode of the catalog. It is needed to distinguish Catalogs rows by the exact Databricks-returned isolation mode value.

Enables: separate Catalogs rows by the exact Databricks-returned isolation_mode label when comparing isolation mode.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Metastore ID

Developer identifier: catalogs.metastore_idMetastore ID records ID of the metastore this catalog belongs to. It is needed to refer to the same metastore across records without relying on display text.

Enables: match metastore_id to metastore references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is an identifier, not a measured quantity.

Metastore Version

Developer identifier: catalogs.metastore_versionMetastore Version records metastore version associated with this catalog record. It is needed to compare the exact metastore version configuration returned for this Catalog record.

Enables: compare the exact metastore_version configuration returned for each Catalog record and select records with the configuration under review.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Name

Developer identifier: catalogs.nameName records name of the catalog. Serves as the primary key. It identifies each Catalogs row across syncs.

Enables: use name as the record key for Catalogs and match repeated rows carrying the same Databricks identifier.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is an identifier, not a measured quantity; it is the record key.

Options

Developer identifier: catalogs.optionsOptions records options for configuring the catalog, such as connection options for foreign catalogs. It is needed to compare the exact options configuration returned for this Catalog record.

Enables: compare the exact options configuration returned for each Catalog record and select records with the configuration under review.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; the schema uses the Generic.JSON scalar.

Owner

Developer identifier: catalogs.ownerOwner records owner of the catalog. It is needed to attribute this Catalogs row to the returned person, account, or organization reference.

Enables: attribute the Catalogs row to the returned person or account and match the exact owner value where it recurs in Databricks.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Properties

Developer identifier: catalogs.propertiesProperties records key-value properties associated with the catalog. It is needed to inspect the exact metadata included with this record.

Enables: inspect the exact metadata keys returned in properties and associate them with the containing Catalogs record.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; the schema uses the Generic.JSON scalar; keys and availability follow this Databricks response and may vary by object type or Databricks configuration.

Provider Name

Developer identifier: catalogs.provider_nameProvider Name records name of the provider, applicable for Delta Sharing catalogs. It is needed to compare the returned provider name for individual Catalogs rows and select rows with a specific provider_name value.

Enables: locate Catalogs rows whose returned provider name exactly matches provider_name and retain the Databricks identifier for any cross-record match.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Provisioning Info

Developer identifier: catalogs.provisioning_infoProvisioning Info records provisioning state information for the catalog. It is needed to preserve the nested provisioning info relationship or details on the parent Catalog record.

Enables: expand provisioning_info to connect the containing Catalog row to its returned provisioning info entries.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is one nested object per containing Catalog object when present.

State

Developer identifier: catalogs.provisioning_info.stateState records current provisioning state of the catalog. It is needed to distinguish Catalogs rows by the exact Databricks-returned state value.

Enables: separate Catalogs rows by the exact Databricks-returned state label when comparing state.
Interpretation: Databricks reports this value on the Provisioning Info object returned for Catalogs; it is interpreted at one Provisioning Info record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Query Federation Attributes

Developer identifier: catalogs.query_federation_attributesQuery Federation Attributes records foreign-catalog federation metadata when catalog_type is FOREIGN_CATALOG. It is needed to inspect the exact metadata included with this record.

Enables: inspect the exact metadata keys returned in query_federation_attributes and associate them with the containing Catalogs record.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is one nested object per containing Catalog object when present; keys and availability follow this Databricks response and may vary by object type or Databricks configuration.

Connection ID

Developer identifier: catalogs.query_federation_attributes.connection_idConnection ID records foreign connection UUID backing the catalog. It is needed to refer to the same connection across records without relying on display text.

Enables: match connection_id to connection references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Query Federation Attributes object returned for Catalogs; it is an identifier, not a measured quantity; the schema uses the Identity.UUID scalar.

Last Refreshed Timestamp

Developer identifier: catalogs.query_federation_attributes.last_refreshed_timestampLast Refreshed Timestamp records epoch milliseconds when federation metadata was last refreshed. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Catalogs records by last_refreshed_timestamp, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Query Federation Attributes object returned for Catalogs; its unit or granularity is epoch milliseconds; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar.

Resource Name

Developer identifier: catalogs.resource_nameResource Name records metastore-relative resource path for the catalog. It is needed to compare the returned resource name for individual Catalogs rows and select rows with a specific resource_name value.

Enables: locate Catalogs rows whose returned resource name exactly matches resource_name and retain the Databricks identifier for any cross-record match.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Securable Kind

Developer identifier: catalogs.securable_kindSecurable Kind records the kind of securable, such as CATALOG_STANDARD or CATALOG_DELTASHARING. It is needed to distinguish Catalogs rows by the exact Databricks-returned securable kind value.

Enables: separate Catalogs rows by the exact Databricks-returned securable_kind label when comparing securable kind.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Securable Type

Developer identifier: catalogs.securable_typeSecurable Type records the securable type of this object, typically CATALOG. It is needed to distinguish Catalogs rows by the exact Databricks-returned securable type value.

Enables: separate Catalogs rows by the exact Databricks-returned securable_type label when comparing securable type.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Storage Location

Developer identifier: catalogs.storage_locationStorage Location records storage location URL for the catalog. It is needed to preserve the Databricks-reported resource location link for the same record.

Enables: correlate the Databricks resource link in storage_location with its containing Catalog row without treating the resource path as a statement of data residency.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row; the schema uses the Network.Uri scalar; the value is resource location link; this Databricks-reported or configured context does not establish residency or verified physical presence.

Storage Root

Developer identifier: catalogs.storage_rootStorage Root records root storage location for managed tables in this catalog. It is needed to compare the returned storage root for individual Catalogs rows and select rows with a specific storage_root value.

Enables: trace the storage root relationship returned in storage_root from the Catalog row to its named Databricks context.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Updated At

Developer identifier: catalogs.updated_atUpdated At records timestamp when the catalog was last updated, in epoch milliseconds. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Catalogs records by updated_at, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; its unit or granularity is epoch milliseconds; Parable uses it to keep the latest version of each record; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar.

Updated By

Developer identifier: catalogs.updated_byUpdated By records user or principal who last updated the catalog. It is needed to attribute this Catalogs row to the returned person, account, or organization reference.

Enables: attribute the Catalogs row to the returned person or account and match the exact updated_by value where it recurs in Databricks.
Interpretation: Databricks reports this value on the Catalog object returned for Catalogs; it is interpreted at one Catalog record per row.

Clusters

Developer identifier: clustersClusters covers clusters in the Databricks workspace. Provides compute cluster metadata including configuration, state, and resource allocation details.

Enables: compare returned cluster configuration, lifecycle state, worker allocation, creator, and activity times. With source permissions on, a reader reads the clusters that they created.
Scope: Lists all clusters in the Databricks workspace. Provides compute cluster metadata including configuration, state, and resource allocation details; Parable reads every record from /api/2.0/clusters/list on each sync. The configured credential must grant the declared all-apis access scope; records outside that access are not returned. This stream has no deletion signal, so a missing row does not establish that the Databricks record was deleted.

Autoscale

Developer identifier: clusters.autoscaleAutoscale records autoscale configuration specifying min and max workers. It is needed to measure the Databricks-reported number of autoscale at one Databricks Cluster record per row.

Enables: measure and compare the Databricks-reported number of autoscale in autoscale at one Databricks Cluster record per row.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is a Databricks-reported count at one Databricks Cluster record per row.

Max Workers

Developer identifier: clusters.autoscale.max_workersMax Workers records maximum number of workers the cluster can scale up to. It is needed to measure the Databricks-reported number of max workers at one Autoscale Config record per row.

Enables: measure and compare the Databricks-reported number of max workers in max_workers at one Autoscale Config record per row.
Interpretation: Databricks reports this value on the Autoscale Config object returned for Clusters; it is a Databricks-reported count at one Autoscale Config record per row.

Min Workers

Developer identifier: clusters.autoscale.min_workersMin Workers records minimum number of workers the cluster can scale down to. It is needed to measure the Databricks-reported number of min workers at one Autoscale Config record per row.

Enables: measure and compare the Databricks-reported number of min workers in min_workers at one Autoscale Config record per row.
Interpretation: Databricks reports this value on the Autoscale Config object returned for Clusters; it is a Databricks-reported count at one Autoscale Config record per row.

AWS Attributes

Developer identifier: clusters.aws_attributesAWS Attributes records AWS-specific cluster attributes (present for AWS workspaces). It is needed to preserve the nested aws attributes relationship or details on the parent Databricks Cluster record.

Enables: expand aws_attributes to connect the containing Databricks Cluster row to its returned aws attributes entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Availability

Developer identifier: clusters.aws_attributes.availabilityAvailability records availability type for the cluster. It is needed to distinguish Clusters rows by the exact Databricks-returned availability value.

Enables: separate Clusters rows by the exact Databricks-returned availability label when comparing availability.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; it is interpreted at one AWS Attributes record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Ebs Volume Count

Developer identifier: clusters.aws_attributes.ebs_volume_countEbs Volume Count records number of EBS volumes attached to each node. It is needed to measure the Databricks-reported number of eBS volumes attached to each node at one AWS Attributes record per row.

Enables: measure and compare the Databricks-reported number of eBS volumes attached to each node in ebs_volume_count at one AWS Attributes record per row.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; it is a Databricks-reported count at one AWS Attributes record per row.

Ebs Volume Iops

Developer identifier: clusters.aws_attributes.ebs_volume_iopsEbs Volume Iops records IOPS for provisioned IOPS EBS volumes. It is needed to compare the numeric ebs volume iops reported for one AWS Attributes record without assuming an unstated unit.

Enables: compare the numeric ebs_volume_iops value per AWS Attributes record without assigning a unit not declared by the schema description.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; it is interpreted at one AWS Attributes record per row.

Ebs Volume Size

Developer identifier: clusters.aws_attributes.ebs_volume_sizeEbs Volume Size records size of each EBS volume in GiB. It is needed to compare the numeric ebs volume size reported for one AWS Attributes record without assuming an unstated unit.

Enables: compare the numeric ebs_volume_size value per AWS Attributes record without assigning a unit not declared by the schema description.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; it is interpreted at one AWS Attributes record per row.

Ebs Volume Throughput

Developer identifier: clusters.aws_attributes.ebs_volume_throughputEbs Volume Throughput records throughput for gp3 EBS volumes in MiB/s. It is needed to compare the numeric ebs volume throughput reported for one AWS Attributes record without assuming an unstated unit.

Enables: compare the numeric ebs_volume_throughput value per AWS Attributes record without assigning a unit not declared by the schema description.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; it is interpreted at one AWS Attributes record per row.

Ebs Volume Type

Developer identifier: clusters.aws_attributes.ebs_volume_typeEbs Volume Type records EBS volume type (e.g. GENERAL_PURPOSE_SSD, THROUGHPUT_OPTIMIZED_HDD). It is needed to distinguish Clusters rows by the exact Databricks-returned ebs volume type value.

Enables: separate Clusters rows by the exact Databricks-returned ebs_volume_type label when comparing ebs volume type.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; it is interpreted at one AWS Attributes record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

First On Demand

Developer identifier: clusters.aws_attributes.first_on_demandFirst On Demand records number of nodes placed on on-demand instances first. It is needed to measure the Databricks-reported number of nodes placed on on-demand instances first at one AWS Attributes record per row.

Enables: measure and compare the Databricks-reported number of nodes placed on on-demand instances first in first_on_demand at one AWS Attributes record per row.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; it is a Databricks-reported count at one AWS Attributes record per row.

Instance Profile Arn

Developer identifier: clusters.aws_attributes.instance_profile_arnInstance Profile Arn records ARN of the instance profile for the cluster. It is needed to inventory the exact Databricks-reported configuration or classification represented by this field.

Enables: compare instance_profile_arn among Clusters records when reconciling this specific configuration, source, or classification.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; it is interpreted at one AWS Attributes record per row; the value is a Databricks-returned or configured label at the Aws Attributes grain rather than a universal taxonomy.

Spot Bid Price Percent

Developer identifier: clusters.aws_attributes.spot_bid_price_percentSpot Bid Price Percent records max bid price as a percentage of on-demand price for spot instances. It is needed to measure the reported spot bid price percent for one aws attributes record.

Enables: measure and compare spot_bid_price_percent per AWS Attributes record in percent.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; its unit or granularity is percent.

Zone ID

Developer identifier: clusters.aws_attributes.zone_idZone ID records AWS availability zone ID. It is needed to refer to the same zone across records without relying on display text.

Enables: match zone_id to zone references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the AWS Attributes object returned for Clusters; it is an identifier, not a measured quantity.

Azure Attributes

Developer identifier: clusters.azure_attributesAzure Attributes records azure-specific cluster attributes (present for Azure workspaces). It is needed to preserve the nested azure attributes relationship or details on the parent Databricks Cluster record.

Enables: expand azure_attributes to connect the containing Databricks Cluster row to its returned azure attributes entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Availability

Developer identifier: clusters.azure_attributes.availabilityAvailability records availability type for the cluster. It is needed to distinguish Clusters rows by the exact Databricks-returned availability value.

Enables: separate Clusters rows by the exact Databricks-returned availability label when comparing availability.
Interpretation: Databricks reports this value on the Azure Attributes object returned for Clusters; it is interpreted at one Azure Attributes record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

First On Demand

Developer identifier: clusters.azure_attributes.first_on_demandFirst On Demand records number of nodes placed on on-demand instances first. It is needed to measure the Databricks-reported number of nodes placed on on-demand instances first at one Azure Attributes record per row.

Enables: measure and compare the Databricks-reported number of nodes placed on on-demand instances first in first_on_demand at one Azure Attributes record per row.
Interpretation: Databricks reports this value on the Azure Attributes object returned for Clusters; it is a Databricks-reported count at one Azure Attributes record per row.

Log Analytics Info

Developer identifier: clusters.azure_attributes.log_analytics_infoLog Analytics Info records log Analytics workspace configuration. It is needed to compare the exact log analytics info configuration returned for this Azure Attributes record.

Enables: compare the exact log_analytics_info configuration returned for each Azure Attributes record and select records with the configuration under review.
Interpretation: Databricks reports this value on the Azure Attributes object returned for Clusters; it is interpreted at one Azure Attributes record per row; the schema uses the Generic.JSON scalar.

Spot Bid Max Price

Developer identifier: clusters.azure_attributes.spot_bid_max_priceSpot Bid Max Price records max bid price for Azure spot instances (-1 for on-demand price). It is needed to measure the exact commercial amount reported on this record.

Enables: measure and compare the reported spot_bid_max_price amount for Clusters records, using the record’s currency code when one is returned.
Interpretation: Databricks reports this value on the Azure Attributes object returned for Clusters; it is interpreted at one Azure Attributes record per row; the Databricks response determines the currency or pricing basis; do not infer one when it is absent.

Cluster Cores

Developer identifier: clusters.cluster_coresCluster Cores records total number of cores available across the cluster. It is needed to measure the Databricks-reported number of cores available across the cluster at one Databricks Cluster record per row.

Enables: measure and compare the Databricks-reported number of cores available across the cluster in cluster_cores at one Databricks Cluster record per row.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is a Databricks-reported count at one Databricks Cluster record per row.

Cluster ID

Developer identifier: clusters.cluster_idCluster ID records unique identifier for the cluster. It identifies each Clusters row across syncs.

Enables: use cluster_id as the record key for Clusters and match repeated rows carrying the same Databricks identifier.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is an identifier, not a measured quantity; it is the record key.

Cluster Log Conf

Developer identifier: clusters.cluster_log_confCluster Log Conf records configuration for delivering Spark logs to a destination. It is needed to preserve the nested cluster log conf relationship or details on the parent Databricks Cluster record.

Enables: expand cluster_log_conf to connect the containing Databricks Cluster row to its returned cluster log conf entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Dbfs

Developer identifier: clusters.cluster_log_conf.dbfsDbfs records DBFS destination for logs. It is needed to preserve the nested dbfs relationship or details on the parent Cluster Log Conf record.

Enables: expand dbfs to connect the containing Cluster Log Conf row to its returned dbfs entries.
Interpretation: Databricks reports this value on the Cluster Log Conf object returned for Clusters; it is one nested object per containing Cluster Log Conf object when present.

Destination

Developer identifier: clusters.cluster_log_conf.dbfs.destinationDestination records DBFS path. It is needed to compare the returned destination for individual Clusters rows and select rows with a specific destination value.

Enables: trace the destination relationship returned in destination from the Dbfs Storage Info row to its named Databricks context.
Interpretation: Databricks reports this value on the Dbfs Storage Info object returned for Clusters; it is interpreted at one Dbfs Storage Info record per row.

Developer identifier: clusters.cluster_log_conf.s3S3 records s3 destination for logs. It is needed to preserve the nested s3 relationship or details on the parent Cluster Log Conf record.

Enables: expand s3 to connect the containing Cluster Log Conf row to its returned s3 entries.
Interpretation: Databricks reports this value on the Cluster Log Conf object returned for Clusters; it is one nested object per containing Cluster Log Conf object when present.

Canned Acl

Developer identifier: clusters.cluster_log_conf.s3.canned_aclCanned Acl records canned ACL to apply. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Clusters rows with the exact canned_acl access-related value being investigated.
Interpretation: Databricks reports this value on the S3 Storage Info object returned for Clusters; it is interpreted at one S3 Storage Info record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Databricks-returned labels rather than a universal taxonomy.

Destination

Developer identifier: clusters.cluster_log_conf.s3.destinationDestination records s3 URI. It is needed to retain the exact Databricks resource or external link reported for this Clusters record.

Enables: open or correlate the resource named by destination while retaining the containing S3 Storage Info row as provenance.
Interpretation: Databricks reports this value on the S3 Storage Info object returned for Clusters; it is interpreted at one S3 Storage Info record per row; the returned link or template does not establish that the current credential can retrieve its target.

Enable Encryption

Developer identifier: clusters.cluster_log_conf.s3.enable_encryptionEnable Encryption records whether server-side encryption is enabled. It is needed to distinguish Clusters rows by the exact Databricks-returned enable encryption value.

Enables: select Clusters rows where enable_encryption is true or false when comparing the condition described by Enable Encryption.
Interpretation: Databricks reports this value on the S3 Storage Info object returned for Clusters; it is interpreted at one S3 Storage Info record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Encryption Type

Developer identifier: clusters.cluster_log_conf.s3.encryption_typeEncryption Type records encryption type (e.g. sse-s3). It is needed to distinguish Clusters rows by the exact Databricks-returned encryption type value.

Enables: separate Clusters rows by the exact Databricks-returned encryption_type label when comparing encryption type.
Interpretation: Databricks reports this value on the S3 Storage Info object returned for Clusters; it is interpreted at one S3 Storage Info record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Endpoint

Developer identifier: clusters.cluster_log_conf.s3.endpointEndpoint records s3 endpoint URL. It is needed to retain the exact Databricks resource or external link reported for this Clusters record.

Enables: open or correlate the resource named by endpoint while retaining the containing S3 Storage Info row as provenance.
Interpretation: Databricks reports this value on the S3 Storage Info object returned for Clusters; it is interpreted at one S3 Storage Info record per row; the returned link or template does not establish that the current credential can retrieve its target.

Kms Key

Developer identifier: clusters.cluster_log_conf.s3.kms_keyKms Key records KMS key for encryption. It is needed to refer to the same kms across records without relying on display text.

Enables: match kms_key to kms references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the S3 Storage Info object returned for Clusters; it is an identifier, not a measured quantity.

Region

Developer identifier: clusters.cluster_log_conf.s3.regionRegion records AWS region of the S3 bucket. It is needed to scope the returned S3 storage configuration to the AWS region named for its bucket.

Enables: combine region with the sibling S3 destination and endpoint when reproducing or investigating the same log-storage configuration.
Interpretation: Databricks reports this value on the S3 Storage Info object returned for Clusters; it is one AWS region label per S3 storage configuration; the label scopes the configured bucket endpoint and does not establish data residency or verified physical storage.

Cluster Log Status

Developer identifier: clusters.cluster_log_statusCluster Log Status records status of log delivery for the cluster. It is needed to preserve the nested cluster log status relationship or details on the parent Databricks Cluster record.

Enables: expand cluster_log_status to connect the containing Databricks Cluster row to its returned cluster log status entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Last Attempted

Developer identifier: clusters.cluster_log_status.last_attemptedLast Attempted records timestamp (epoch ms) of the last log sync attempt. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Clusters records by last_attempted, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Log Sync Status object returned for Clusters; its unit or granularity is epoch milliseconds; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar.

Last Exception

Developer identifier: clusters.cluster_log_status.last_exceptionLast Exception records exception message from the last failed sync attempt. It is needed to inspect the exact exception message returned for this Log Sync Status record.

Enables: attribute the exception message in last_exception to the containing Clusters identifier, owner or author, status, and update time where returned.
Interpretation: Databricks reports this value on the Log Sync Status object returned for Clusters; it is interpreted at one Log Sync Status record per row; this is only the exception message included in the Databricks response for this record.

Cluster Memory Mb

Developer identifier: clusters.cluster_memory_mbCluster Memory Mb records total cluster memory in megabytes. It is needed to measure the reported cluster memory mb for one databricks cluster record.

Enables: measure and compare cluster_memory_mb per Databricks Cluster record in megabytes.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; its unit or granularity is megabytes.

Cluster Name

Developer identifier: clusters.cluster_nameCluster Name records human-readable name of the cluster. It is needed to compare the returned cluster name for individual Clusters rows and select rows with a specific cluster_name value.

Enables: locate Clusters rows whose returned cluster name exactly matches cluster_name and retain the Databricks identifier for any cross-record match.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row.

Cluster Source

Developer identifier: clusters.cluster_sourceCluster Source records source that created the cluster (UI, API, JOB, etc.). It is needed to distinguish Clusters rows by the exact Databricks-returned cluster source value.

Enables: separate Clusters rows by the exact Databricks-returned cluster_source label when comparing cluster source.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Creator User Name

Developer identifier: clusters.creator_user_nameCreator User Name records username of the user who created the cluster. It is needed to attribute this Clusters row to the returned person, account, or organization reference.

Enables: attribute the Clusters row to the returned person or account and match the exact creator_user_name value where it recurs in Databricks.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row.

Custom Tags

Developer identifier: clusters.custom_tagsCustom Tags records custom user-defined tags applied to the cluster. It is needed to distinguish Clusters rows by the exact Databricks-returned custom tags value.

Enables: separate Clusters rows by the exact Databricks-returned custom_tags label when comparing custom tags.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; the schema uses the Generic.JSON scalar; classification values are Databricks-returned labels rather than a universal taxonomy.

Data Security Mode

Developer identifier: clusters.data_security_modeData Security Mode records data security mode for the cluster (Unity Catalog access mode). It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: select Clusters rows with the exact data_security_mode access-related value being investigated.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented; classification values are Databricks-returned labels rather than a universal taxonomy.

Default Tags

Developer identifier: clusters.default_tagsDefault Tags records default tags automatically applied to the cluster by Databricks. It is needed to distinguish Clusters rows by the exact Databricks-returned default tags value.

Enables: separate Clusters rows by the exact Databricks-returned default_tags label when comparing default tags.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; the schema uses the Generic.JSON scalar; classification values are Databricks-returned labels rather than a universal taxonomy.

Disk Spec

Developer identifier: clusters.disk_specDisk Spec records disk specification for worker nodes. It is needed to preserve the nested disk spec relationship or details on the parent Databricks Cluster record.

Enables: expand disk_spec to connect the containing Databricks Cluster row to its returned disk spec entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Disk Count

Developer identifier: clusters.disk_spec.disk_countDisk Count records number of disks per node. It is needed to measure the Databricks-reported number of disks per node at one Disk Spec record per row.

Enables: measure and compare the Databricks-reported number of disks per node in disk_count at one Disk Spec record per row.
Interpretation: Databricks reports this value on the Disk Spec object returned for Clusters; it is a Databricks-reported count at one Disk Spec record per row.

Disk Iops

Developer identifier: clusters.disk_spec.disk_iopsDisk Iops records IOPS for the disk. It is needed to compare the numeric disk iops reported for one Disk Spec record without assuming an unstated unit.

Enables: compare the numeric disk_iops value per Disk Spec record without assigning a unit not declared by the schema description.
Interpretation: Databricks reports this value on the Disk Spec object returned for Clusters; it is interpreted at one Disk Spec record per row.

Disk Size

Developer identifier: clusters.disk_spec.disk_sizeDisk Size records size of each disk in GiB. It is needed to compare the numeric disk size reported for one Disk Spec record without assuming an unstated unit.

Enables: compare the numeric disk_size value per Disk Spec record without assigning a unit not declared by the schema description.
Interpretation: Databricks reports this value on the Disk Spec object returned for Clusters; it is interpreted at one Disk Spec record per row.

Disk Throughput

Developer identifier: clusters.disk_spec.disk_throughputDisk Throughput records throughput for the disk in MiB/s. It is needed to compare the numeric disk throughput reported for one Disk Spec record without assuming an unstated unit.

Enables: compare the numeric disk_throughput value per Disk Spec record without assigning a unit not declared by the schema description.
Interpretation: Databricks reports this value on the Disk Spec object returned for Clusters; it is interpreted at one Disk Spec record per row.

Disk Type

Developer identifier: clusters.disk_spec.disk_typeDisk Type records disk type configuration. It is needed to preserve the nested disk type relationship or details on the parent Disk Spec record.

Enables: expand disk_type to connect the containing Disk Spec row to its returned disk type entries.
Interpretation: Databricks reports this value on the Disk Spec object returned for Clusters; it is one nested object per containing Disk Spec object when present.

Azure Disk Volume Type

Developer identifier: clusters.disk_spec.disk_type.azure_disk_volume_typeAzure Disk Volume Type records azure managed disk type. It is needed to distinguish Clusters rows by the exact Databricks-returned azure disk volume type value.

Enables: separate Clusters rows by the exact Databricks-returned azure_disk_volume_type label when comparing azure disk volume type.
Interpretation: Databricks reports this value on the Disk Type object returned for Clusters; it is interpreted at one Disk Type record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Ebs Volume Type

Developer identifier: clusters.disk_spec.disk_type.ebs_volume_typeEbs Volume Type records EBS volume type (AWS). It is needed to distinguish Clusters rows by the exact Databricks-returned ebs volume type value.

Enables: separate Clusters rows by the exact Databricks-returned ebs_volume_type label when comparing ebs volume type.
Interpretation: Databricks reports this value on the Disk Type object returned for Clusters; it is interpreted at one Disk Type record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Docker Image

Developer identifier: clusters.docker_imageDocker Image records custom Docker image for the cluster (Databricks Container Services). It is needed to preserve the nested docker image relationship or details on the parent Databricks Cluster record.

Enables: expand docker_image to connect the containing Databricks Cluster row to its returned docker image entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Basic Auth

Developer identifier: clusters.docker_image.basic_authBasic Auth records basic authentication credentials for the Docker registry. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand basic_auth to examine the returned basic auth details for the containing Docker Image record.
Interpretation: Databricks reports this value on the Docker Image object returned for Clusters; it is one nested object per containing Docker Image object when present; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Password

Developer identifier: clusters.docker_image.basic_auth.passwordPassword records docker registry password. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact password access value with the resource, account, or membership represented by the same Clusters row.
Interpretation: Databricks reports this value on the Docker Basic Auth object returned for Clusters; it is interpreted at one Docker Basic Auth record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

User Name

Developer identifier: clusters.docker_image.basic_auth.usernameUser Name records docker registry username. It is needed to attribute this Clusters row to the returned person, account, or organization reference.

Enables: attribute the Clusters row to the returned person or account and match the exact username value where it recurs in Databricks.
Interpretation: Databricks reports this value on the Docker Basic Auth object returned for Clusters; it is interpreted at one Docker Basic Auth record per row.

URL

Developer identifier: clusters.docker_image.urlURL records docker image URL. It is needed to inspect the exact link included with this record.

Enables: open or correlate the exact Databricks resource referenced by url while retaining the containing Clusters record as provenance.
Interpretation: Databricks reports this value on the Docker Image object returned for Clusters; it is link at one Docker Image record per row; the schema uses the Network.Url scalar; the returned link or template does not establish that the current credential can retrieve its target.

Driver

Developer identifier: clusters.driverDriver records information about the driver node. It is needed to preserve the nested driver relationship or details on the parent Databricks Cluster record.

Enables: expand driver to connect the containing Databricks Cluster row to its returned driver entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Host Private IP

Developer identifier: clusters.driver.host_private_ipHost Private IP records the private network address of the host underlying the Spark node. It is needed to correlate that host address with the containing cluster and node inventory.

Enables: compare host_private_ip with private_ip, node_id, instance_id, and the containing Clusters record when reconciling returned hosts and Spark nodes.
Interpretation: Databricks reports this value on the Spark Node object returned for Clusters; it identifies the host’s private network address in that cluster inventory.

Instance ID

Developer identifier: clusters.driver.instance_idInstance ID records cloud provider instance ID. It is needed to refer to the same instance across records without relying on display text.

Enables: match instance_id to instance references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Spark Node object returned for Clusters; it is an identifier, not a measured quantity.

Node AWS Attributes

Developer identifier: clusters.driver.node_aws_attributesNode AWS Attributes records AWS-specific node attributes. It is needed to inspect the exact metadata included with this record.

Enables: inspect the exact metadata keys returned in node_aws_attributes and associate them with the containing Clusters record.
Interpretation: Databricks reports this value on the Spark Node object returned for Clusters; it is interpreted at one Spark Node record per row; the schema uses the Generic.JSON scalar; keys and availability follow this Databricks response and may vary by object type or Databricks configuration.

Node ID

Developer identifier: clusters.driver.node_idNode ID records unique identifier for the node. It is needed to refer to the same node across records without relying on display text.

Enables: match node_id to node references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Spark Node object returned for Clusters; it is an identifier, not a measured quantity.

Private IP

Developer identifier: clusters.driver.private_ipPrivate IP records the private network address assigned to the Spark node. It is needed to correlate that node address with the containing cluster and node inventory.

Enables: match private_ip with node_id, instance_id, and the containing Clusters record when reconciling returned Spark nodes.
Interpretation: Databricks reports this value on the Spark Node object returned for Clusters; it identifies the node’s private network address in that cluster inventory.

Public DNS

Developer identifier: clusters.driver.public_dnsPublic DNS records public DNS name of the node. It is needed to distinguish Clusters rows by the exact Databricks-returned public dns value.

Enables: separate Clusters rows by the exact Databricks-returned public_dns label when comparing public dns.
Interpretation: Databricks reports this value on the Spark Node object returned for Clusters; it is interpreted at one Spark Node record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Start Timestamp

Developer identifier: clusters.driver.start_timestampStart Timestamp records timestamp (epoch ms) when the node was started. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Clusters records by start_timestamp, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Spark Node object returned for Clusters; its unit or granularity is epoch milliseconds; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar.

Driver Instance Pool ID

Developer identifier: clusters.driver_instance_pool_idDriver Instance Pool ID records ID of the instance pool used for the driver node. It is needed to refer to the same driver instance pool across records without relying on display text.

Enables: match driver_instance_pool_id to driver instance pool references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is an identifier, not a measured quantity.

Driver Node Type ID

Developer identifier: clusters.driver_node_type_idDriver Node Type ID records instance type identifier for the driver node. It is needed to refer to the same driver node type across records without relying on display text.

Enables: match driver_node_type_id to driver node type references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is an identifier, not a measured quantity; classification values are Databricks-returned labels rather than a universal taxonomy.

Effective Spark Version

Developer identifier: clusters.effective_spark_versionEffective Spark Version records the effective Spark version after resolution. It is needed to compare the exact effective spark version configuration returned for this Databricks Cluster record.

Enables: compare the exact effective_spark_version configuration returned for each Databricks Cluster record and select records with the configuration under review.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row.

Enable Elastic Disk

Developer identifier: clusters.enable_elastic_diskEnable Elastic Disk records whether autoscaling local storage is enabled. It is needed to distinguish Clusters rows by the exact Databricks-returned enable elastic disk value.

Enables: select Clusters rows where enable_elastic_disk is true or false when comparing the condition described by Enable Elastic Disk.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Enable Local Disk Encryption

Developer identifier: clusters.enable_local_disk_encryptionEnable Local Disk Encryption records whether local disk encryption is enabled. It is needed to distinguish Clusters rows by the exact Databricks-returned enable local disk encryption value.

Enables: select Clusters rows where enable_local_disk_encryption is true or false when comparing the condition described by Enable Local Disk Encryption.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Executors

Developer identifier: clusters.executorsExecutors records list of executor/worker node information. It is needed to preserve the nested executors relationship or details on the parent Databricks Cluster record.

Enables: expand executors to connect the containing Databricks Cluster row to its returned executors entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one returned collection per containing Databricks Cluster object.

GCP Attributes

Developer identifier: clusters.gcp_attributesGCP Attributes records GCP-specific cluster attributes (present for GCP workspaces). It is needed to preserve the nested gcp attributes relationship or details on the parent Databricks Cluster record.

Enables: expand gcp_attributes to connect the containing Databricks Cluster row to its returned gcp attributes entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Availability

Developer identifier: clusters.gcp_attributes.availabilityAvailability records availability type for the cluster. It is needed to distinguish Clusters rows by the exact Databricks-returned availability value.

Enables: separate Clusters rows by the exact Databricks-returned availability label when comparing availability.
Interpretation: Databricks reports this value on the GCP Attributes object returned for Clusters; it is interpreted at one GCP Attributes record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Boot Disk Size

Developer identifier: clusters.gcp_attributes.boot_disk_sizeBoot Disk Size records boot disk size in GiB. It is needed to compare the numeric boot disk size reported for one GCP Attributes record without assuming an unstated unit.

Enables: compare the numeric boot_disk_size value per GCP Attributes record without assigning a unit not declared by the schema description.
Interpretation: Databricks reports this value on the GCP Attributes object returned for Clusters; it is interpreted at one GCP Attributes record per row.

Google Service Account

Developer identifier: clusters.gcp_attributes.google_service_accountGoogle Service Account records google service account email for the cluster. It is needed to attribute this Clusters row to the returned person, account, or organization reference.

Enables: attribute the Clusters row to the returned person or account and match the exact google_service_account value where it recurs in Databricks.
Interpretation: Databricks reports this value on the GCP Attributes object returned for Clusters; it is interpreted at one GCP Attributes record per row.

Local Ssd Count

Developer identifier: clusters.gcp_attributes.local_ssd_countLocal Ssd Count records number of local SSDs attached to each node. It is needed to measure the Databricks-reported number of local SSDs attached to each node at one GCP Attributes record per row.

Enables: measure and compare the Databricks-reported number of local SSDs attached to each node in local_ssd_count at one GCP Attributes record per row.
Interpretation: Databricks reports this value on the GCP Attributes object returned for Clusters; it is a Databricks-reported count at one GCP Attributes record per row.

Use Preemptible Executors

Developer identifier: clusters.gcp_attributes.use_preemptible_executorsUse Preemptible Executors records whether to use preemptible VMs for executors. It is needed to distinguish Clusters rows by the exact Databricks-returned use preemptible executors value.

Enables: select Clusters rows where use_preemptible_executors is true or false when comparing the condition described by Use Preemptible Executors.
Interpretation: Databricks reports this value on the GCP Attributes object returned for Clusters; it is interpreted at one GCP Attributes record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Zone ID

Developer identifier: clusters.gcp_attributes.zone_idZone ID records GCP zone ID for the cluster. It is needed to refer to the same zone across records without relying on display text.

Enables: match zone_id to zone references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the GCP Attributes object returned for Clusters; it is an identifier, not a measured quantity.

Init Scripts

Developer identifier: clusters.init_scriptsInit Scripts records list of init scripts configured for the cluster. It is needed to preserve the nested init scripts relationship or details on the parent Databricks Cluster record.

Enables: expand init_scripts to connect the containing Databricks Cluster row to its returned init scripts entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one returned collection per containing Databricks Cluster object.

Abfss

Developer identifier: clusters.init_scripts.abfssAbfss records azure ABFSS location for the init script. It is needed to preserve the nested abfss relationship or details on the parent Init Script Info record.

Enables: expand abfss to connect the containing Init Script Info row to its returned abfss entries.
Interpretation: Databricks reports this value on the Init Script Info object returned for Clusters; it is one nested object per containing Init Script Info object when present.

Destination

Developer identifier: clusters.init_scripts.abfss.destinationDestination records ABFSS URI. It is needed to retain the exact Databricks resource or external link reported for this Clusters record.

Enables: open or correlate the resource named by destination while retaining the containing Abfss Storage Info row as provenance.
Interpretation: Databricks reports this value on the Abfss Storage Info object returned for Clusters; it is interpreted at one Abfss Storage Info record per row; the returned link or template does not establish that the current credential can retrieve its target.

Dbfs

Developer identifier: clusters.init_scripts.dbfsDbfs records DBFS path for the init script. It is needed to preserve the nested dbfs relationship or details on the parent Init Script Info record.

Enables: expand dbfs to connect the containing Init Script Info row to its returned dbfs entries.
Interpretation: Databricks reports this value on the Init Script Info object returned for Clusters; it is one nested object per containing Init Script Info object when present.

Gcs

Developer identifier: clusters.init_scripts.gcsGcs records GCS location for the init script. It is needed to preserve the nested gcs relationship or details on the parent Init Script Info record.

Enables: expand gcs to connect the containing Init Script Info row to its returned gcs entries.
Interpretation: Databricks reports this value on the Init Script Info object returned for Clusters; it is one nested object per containing Init Script Info object when present.

Destination

Developer identifier: clusters.init_scripts.gcs.destinationDestination records GCS URI. It is needed to retain the exact Databricks resource or external link reported for this Clusters record.

Enables: open or correlate the resource named by destination while retaining the containing Gcs Storage Info row as provenance.
Interpretation: Databricks reports this value on the Gcs Storage Info object returned for Clusters; it is interpreted at one Gcs Storage Info record per row; the returned link or template does not establish that the current credential can retrieve its target.

Developer identifier: clusters.init_scripts.s3S3 records s3 location for the init script. It is needed to preserve the nested s3 relationship or details on the parent Init Script Info record.

Enables: expand s3 to connect the containing Init Script Info row to its returned s3 entries.
Interpretation: Databricks reports this value on the Init Script Info object returned for Clusters; it is one nested object per containing Init Script Info object when present.

Volumes

Developer identifier: clusters.init_scripts.volumesVolumes records Unity Catalog volumes path for the init script. It is needed to preserve the nested volumes relationship or details on the parent Init Script Info record.

Enables: expand volumes to connect the containing Init Script Info row to its returned volumes entries.
Interpretation: Databricks reports this value on the Init Script Info object returned for Clusters; it is one nested object per containing Init Script Info object when present.

Destination

Developer identifier: clusters.init_scripts.volumes.destinationDestination records volumes path. It is needed to compare the returned destination for individual Clusters rows and select rows with a specific destination value.

Enables: trace the destination relationship returned in destination from the Volumes Storage Info row to its named Databricks context.
Interpretation: Databricks reports this value on the Volumes Storage Info object returned for Clusters; it is interpreted at one Volumes Storage Info record per row.

Workspace

Developer identifier: clusters.init_scripts.workspaceWorkspace records workspace file system path for the init script. It is needed to preserve the nested workspace relationship or details on the parent Init Script Info record.

Enables: expand workspace to connect the containing Init Script Info row to its returned workspace entries.
Interpretation: Databricks reports this value on the Init Script Info object returned for Clusters; it is one nested object per containing Init Script Info object when present.

Destination

Developer identifier: clusters.init_scripts.workspace.destinationDestination records workspace file path. It is needed to compare the returned destination for individual Clusters rows and select rows with a specific destination value.

Enables: trace the destination relationship returned in destination from the Workspace Storage Info row to its named Databricks context.
Interpretation: Databricks reports this value on the Workspace Storage Info object returned for Clusters; it is interpreted at one Workspace Storage Info record per row.

Instance Pool ID

Developer identifier: clusters.instance_pool_idInstance Pool ID records ID of the instance pool used for worker nodes. It is needed to refer to the same instance pool across records without relying on display text.

Enables: match instance_pool_id to instance pool references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is an identifier, not a measured quantity.

Last Activity Time

Developer identifier: clusters.last_activity_timeLast Activity Time records timestamp (epoch milliseconds) of the last activity on the cluster. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Clusters records by last_activity_time, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; its unit or granularity is epoch milliseconds; Parable uses it to keep the latest version of each record; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar.

Last Restarted Time

Developer identifier: clusters.last_restarted_timeLast Restarted Time records timestamp (epoch milliseconds) when the cluster was last restarted. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Clusters records by last_restarted_time, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; its unit or granularity is epoch milliseconds; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar.

Last State Loss Time

Developer identifier: clusters.last_state_loss_timeLast State Loss Time records timestamp (epoch milliseconds) of the last state loss event. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Clusters records by last_state_loss_time, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; its unit or granularity is epoch milliseconds; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar; classification values are Databricks-returned labels rather than a universal taxonomy.

Node Type ID

Developer identifier: clusters.node_type_idNode Type ID records instance type identifier for worker nodes. It is needed to refer to the same node type across records without relying on display text.

Enables: match node_type_id to node type references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is an identifier, not a measured quantity; classification values are Databricks-returned labels rather than a universal taxonomy.

Num Workers

Developer identifier: clusters.num_workersNum Workers records fixed number of worker nodes (mutually exclusive with autoscale). It is needed to measure the Databricks-reported number of num workers at one Databricks Cluster record per row.

Enables: measure and compare the Databricks-reported number of num workers in num_workers at one Databricks Cluster record per row.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is a Databricks-reported count at one Databricks Cluster record per row.

Policy ID

Developer identifier: clusters.policy_idPolicy ID records ID of the cluster policy used to create this cluster. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact policy_id access value with the resource, account, or membership represented by the same Clusters row.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is an identifier, not a measured quantity; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Runtime Engine

Developer identifier: clusters.runtime_engineRuntime Engine records runtime engine type (STANDARD or PHOTON). It is needed to distinguish Clusters rows by the exact Databricks-returned runtime engine value.

Enables: separate Clusters rows by the exact Databricks-returned runtime_engine label when comparing runtime engine.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Single User Name

Developer identifier: clusters.single_user_nameSingle User Name records single user name for single-user access mode clusters. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact single_user_name access value with the resource, account, or membership represented by the same Clusters row.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Spark Conf

Developer identifier: clusters.spark_confSpark Conf records spark configuration key-value pairs set on the cluster. It is needed to compare the exact spark conf configuration returned for this Databricks Cluster record.

Enables: compare the exact spark_conf configuration returned for each Databricks Cluster record and select records with the configuration under review.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; the schema uses the Generic.JSON scalar.

Spark Env Vars

Developer identifier: clusters.spark_env_varsSpark Env Vars records environment variables set for Spark processes. It is needed to preserve the exact Databricks configuration or execution metadata attached to this Databricks Cluster record.

Enables: inspect the keys in spark_env_vars when reproducing or investigating this record’s configuration, parameters, or execution context.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; the schema uses the Generic.JSON scalar; metadata keys and availability follow the Databricks response and can vary by resource type or configuration.

Spark Version

Developer identifier: clusters.spark_versionSpark Version records spark runtime version string (e.g. 13.3.x-scala2.12). It is needed to compare the exact spark version configuration returned for this Databricks Cluster record.

Enables: compare the exact spark_version configuration returned for each Databricks Cluster record and select records with the configuration under review.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row.

Spec

Developer identifier: clusters.specSpec records the original cluster specification used to create or edit the cluster. It is needed to preserve the exact Databricks configuration or execution metadata attached to this Databricks Cluster record.

Enables: inspect the keys in spec when reproducing or investigating this record’s configuration, parameters, or execution context.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; the schema uses the Generic.JSON scalar; metadata keys and availability follow the Databricks response and can vary by resource type or configuration.

SSH Public Keys

Developer identifier: clusters.ssh_public_keysSSH Public Keys records SSH public keys added to the cluster for access. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand ssh_public_keys to examine the returned ssh public keys details for the containing Databricks Cluster record.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one returned collection per containing Databricks Cluster object; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Start Time

Developer identifier: clusters.start_timeStart Time records timestamp (epoch milliseconds) when the cluster was started. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Clusters records by start_time, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; its unit or granularity is epoch milliseconds; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar.

State

Developer identifier: clusters.stateState records current lifecycle state of the cluster. It is needed to distinguish Clusters rows by the exact Databricks-returned state value.

Enables: separate Clusters rows by the exact Databricks-returned state label when comparing state.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is interpreted at one Databricks Cluster record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

State Message

Developer identifier: clusters.state_messageState Message records informational message associated with the current cluster state. It is needed to inspect the exact message text included with this record.

Enables: inspect the message text returned in state_message and attribute it to the same record’s parent record, owner, status, and update time where returned.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is message text at one Databricks Cluster record per row; this is only the content included in the Databricks response for this record; classification values are Databricks-returned labels rather than a universal taxonomy.

Terminated Time

Developer identifier: clusters.terminated_timeTerminated Time records timestamp (epoch milliseconds) when the cluster was terminated. It is needed to place the record at the time or date reported for this event or state.

Enables: bound Clusters records by terminated_time, order their returned events or state changes, and correlate records reported at the same time.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; its unit or granularity is epoch milliseconds; the provider sends it as milliseconds since the Unix epoch; the schema uses the Temporal.DateTime scalar.

Termination Reason

Developer identifier: clusters.termination_reasonTermination Reason records details about why the cluster was terminated. It is needed to preserve the nested termination reason relationship or details on the parent Databricks Cluster record.

Enables: expand termination_reason to connect the containing Databricks Cluster row to its returned termination reason entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Code

Developer identifier: clusters.termination_reason.codeCode records termination reason code (e.g. USER_REQUEST, INACTIVITY). It is needed to distinguish Clusters rows by the exact Databricks-returned code value.

Enables: separate Clusters rows by the exact Databricks-returned code label when comparing code.
Interpretation: Databricks reports this value on the Termination Reason object returned for Clusters; it is interpreted at one Termination Reason record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Parameters

Developer identifier: clusters.termination_reason.parametersParameters records additional parameters providing context for the termination. It is needed to preserve the exact Databricks configuration or execution metadata attached to this Termination Reason record.

Enables: inspect the keys in parameters when reproducing or investigating this record’s configuration, parameters, or execution context.
Interpretation: Databricks reports this value on the Termination Reason object returned for Clusters; it is interpreted at one Termination Reason record per row; the schema uses the Generic.JSON scalar; metadata keys and availability follow the Databricks response and can vary by resource type or configuration.

Type

Developer identifier: clusters.termination_reason.typeType records termination type (e.g. SUCCESS, CLIENT_ERROR, SERVICE_FAULT). It is needed to distinguish Clusters rows by the exact Databricks-returned type value.

Enables: separate Clusters rows by the exact Databricks-returned type label when comparing type.
Interpretation: Databricks reports this value on the Termination Reason object returned for Clusters; it is interpreted at one Termination Reason record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Workload Type

Developer identifier: clusters.workload_typeWorkload Type records workload type configuration for the cluster. It is needed to preserve the nested workload type relationship or details on the parent Databricks Cluster record.

Enables: expand workload_type to connect the containing Databricks Cluster row to its returned workload type entries.
Interpretation: Databricks reports this value on the Databricks Cluster object returned for Clusters; it is one nested object per containing Databricks Cluster object when present.

Clients

Developer identifier: clusters.workload_type.clientsClients records client workload types enabled on the cluster. It is needed to preserve the nested clients relationship or details on the parent Workload Type record.

Enables: expand clients to connect the containing Workload Type row to its returned clients entries.
Interpretation: Databricks reports this value on the Workload Type object returned for Clusters; it is one nested object per containing Workload Type object when present.

Jobs

Developer identifier: clusters.workload_type.clients.jobsJobs records whether job workloads are enabled. It is needed to distinguish Clusters rows by the exact Databricks-returned jobs value.

Enables: select Clusters rows where jobs is true or false when comparing the condition described by Jobs.
Interpretation: Databricks reports this value on the Workload Type Clients object returned for Clusters; it is interpreted at one Workload Type Clients record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Notebooks

Developer identifier: clusters.workload_type.clients.notebooksNotebooks records whether notebook workloads are enabled. It is needed to distinguish Clusters rows by the exact Databricks-returned notebooks value.

Enables: select Clusters rows where notebooks is true or false when comparing the condition described by Notebooks.
Interpretation: Databricks reports this value on the Workload Type Clients object returned for Clusters; it is interpreted at one Workload Type Clients record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Group Members

Developer identifier: group_membersGroup Members covers the members of each Databricks workspace group: one record for each user, service principal or nested group in each group.

Enables: relate each group to its member users, service principals and nested groups. With source permissions on, a member of a group reads the Unity Catalog objects that the group owns, also through nested groups. Only readers with All data access read this stream.
Scope: Reads /api/2.0/preview/scim/v2/Groups/{id} once for each group that groups returns on each sync, and keeps the group’s members array. The configured credential must grant the declared all-apis access scope; records outside that access are not returned. A member absent from a later complete read left the group, and Parable marks the record deleted.

Resource Reference

Developer identifier: group_members.$refResource Reference. The SCIM URI reference of the member resource, such as Users/<id>, Groups/<id> or ServicePrincipals/<id>.

Enables: tell the member’s resource type from its path when type is absent.
Interpretation: Databricks returns this relative SCIM reference on each member of the group resource; it is not a URL Parable opens.

Display

Developer identifier: group_members.displayDisplay. The display name of the member: a user’s display name, a group’s name or a service principal’s name.

Enables: label each membership with the member’s name without a join.
Interpretation: Databricks returns this label on each member of the group resource; a name is not a key, and two members can share one.

Group ID

Developer identifier: group_members.group_idGroup ID. The SCIM ID of the group whose members array held this record.

Enables: join the membership to groups.id. For source permissions, the member belongs to this group and reads what the group owns.
Interpretation: Parable copies this value from the parent group row; Databricks does not repeat it inside each member object.

Membership Key

Developer identifier: group_members.membership_keyMembership Key. A key Parable builds from group_id and value, so each member of each group has one key.

Enables: keep one row for each member in each group, because one user can belong to several groups.
Interpretation: Databricks does not supply this value. Parable computes it when it reads the record, and it is the record key.

Type

Developer identifier: group_members.typeType. Whether the member is a user, a nested group or a service principal.

Enables: separate user members from nested groups and service principals. For source permissions, a user member and the members of a nested group read what the group owns, and a service principal member reads nothing.
Interpretation: Databricks returns this label on each member of the group resource; Parable keeps it as returned.

Value

Developer identifier: group_members.valueValue. The SCIM ID of the member: a user, a nested group or a service principal.

Enables: join the membership to users.id, groups.id or service_principals.id, as type says. For source permissions, this ID names the member.
Interpretation: Databricks returns the member’s SCIM ID as value on each member of the group resource.

Groups

Developer identifier: groupsGroups covers groups in the Databricks workspace via the SCIM v2 API. Provides group membership and role information.

Enables: map the Databricks accounts and memberships represented by Groups records and trace a returned access assignment to its account or group. With source permissions on, a Unity Catalog object that a group owns opens to the group’s members, and Parable matches the owner name to displayName. Only readers with All data access read this stream.
Scope: Lists all groups in the Databricks workspace via the SCIM v2 API. Provides group membership and role information; Parable reads every record from /api/2.0/preview/scim/v2/Groups on each sync. The configured credential must grant the declared all-apis access scope; records outside that access are not returned. A record absent from a later complete read was removed from the workspace or became unreadable to the credential, and Parable marks it deleted.

Display Name

Developer identifier: groups.displayNameDisplay Name records display name of the group. It is needed to compare the returned display name for individual Groups rows and select rows with a specific displayName value.

Enables: locate Groups rows whose returned display name exactly matches displayName and retain the Databricks identifier for any cross-record match.
Interpretation: Databricks reports this value on the Databricks Group object returned for Groups; it is interpreted at one Databricks Group record per row.

Entitlements

Developer identifier: groups.entitlementsEntitlements records array of entitlements assigned to the group, such as workspace-level permissions. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: expand entitlements to examine the returned entitlements details for the containing Databricks Group record.
Interpretation: Databricks reports this value on the Databricks Group object returned for Groups; it is one returned collection per containing Databricks Group object; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

Value

Developer identifier: groups.entitlements.valueValue records the entitlement value, e.g., ‘allow-cluster-create’, ‘allow-instance-pool-create’, ‘databricks-sql-access’, ‘workspace-access’. It is needed to correlate the returned access or audit evidence with the subject and action represented by the same record.

Enables: correlate the exact value access value with the resource, account, or membership represented by the same Groups row.
Interpretation: Databricks reports this value on the Group Entitlement object returned for Groups; it is interpreted at one Group Entitlement record per row; use it for investigation and evidence correlation; it does not prove that all activity or access is represented.

External ID

Developer identifier: groups.externalIdExternal ID records external ID from the identity provider (e.g., Azure AD, Okta). It is needed to refer to the same external across records without relying on display text.

Enables: match externalId to external references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Databricks Group object returned for Groups; it is an identifier, not a measured quantity.

Groups

Developer identifier: groups.groupsGroups records parent groups that this group belongs to (nested group membership). It is needed to preserve the nested groups relationship or details on the parent Databricks Group record.

Enables: expand groups to connect the containing Databricks Group row to its returned groups entries.
Interpretation: Databricks reports this value on the Databricks Group object returned for Groups; it is one returned collection per containing Databricks Group object.

Resource Reference

Developer identifier: groups.groups.$refResource Reference records URI reference to the parent group resource. It is needed to refer to the same the across records without relying on display text.

Enables: match $ref to the references carrying the same Databricks-issued value in related Databricks records.
Interpretation: Databricks reports this value on the Group Reference object returned for Groups; it is an identifier, not a measured quantity.

Display

Developer identifier: groups.groups.displayDisplay records the display name of the parent group. It is needed to compare the returned display for individual Groups rows and select rows with a specific display value.

Enables: locate Groups rows whose returned display exactly matches display and retain the Databricks identifier for any cross-record match.
Interpretation: Databricks reports this value on the Group Reference object returned for Groups; it is interpreted at one Group Reference record per row.

Type

Developer identifier: groups.groups.typeType records the type of the reference, typically ‘direct’ or ‘indirect’. It is needed to distinguish Groups rows by the exact Databricks-returned type value.

Enables: separate Groups rows by the exact Databricks-returned type label when comparing type.
Interpretation: Databricks reports this value on the Group Reference object returned for Groups; it is interpreted at one Group Reference record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Value

Developer identifier: groups.groups.valueValue records the SCIM ID of the parent group. It is needed to compare the returned value for individual Groups rows and select rows with a specific value value.

Enables: trace the value relationship returned in value from the Group Reference row to its named Databricks context.
Interpretation: Databricks reports this value on the Group Reference object returned for Groups; it is interpreted at one Group Reference record per row.

Developer identifier: groups.idID records unique SCIM identifier for the group. It identifies each Groups row across syncs.

Enables: use id as the record key for Groups and match repeated rows carrying the same Databricks identifier.
Interpretation: Databricks reports this value on the Databricks Group object returned for Groups; it is an identifier, not a measured quantity; it is the record key.

Members

Developer identifier: groups.membersMembers records array of group members. Each entry references a user or service principal by SCIM ID. It is needed to preserve the nested members relationship or details on the parent Databricks Group record.

Enables: expand members to connect the containing Databricks Group row to its returned members entries.
Interpretation: Databricks reports this value on the Databricks Group object returned for Groups; it is one returned collection per containing Databricks Group object.

Resource Reference

Developer identifier: groups.members.$refResource Reference records the URI reference to the group member resource (for example, Users/<id> or Groups/<id>). It is needed to identify the exact Databricks user or group represented by each membership.

Enables: use $ref to correlate the membership with the matching Users or Groups record.
Interpretation: Databricks reports this SCIM resource reference on the Group Member object returned for Groups; it is a relative resource identifier, not a measured quantity.

Display

Developer identifier: groups.members.displayDisplay records the display name of the member. It is needed to attribute this Groups row to the returned person, account, or organization reference.

Enables: attribute the Groups row to the returned person or account and match the exact display value where it recurs in Databricks.
Interpretation: Databricks reports this value on the Group Member object returned for Groups; it is interpreted at one Group Member record per row.

Type

Developer identifier: groups.members.typeType records the type of the member resource. It is needed to distinguish Groups rows by the exact Databricks-returned type value.

Enables: separate Groups rows by the exact Databricks-returned type label when comparing type.
Interpretation: Databricks reports this value on the Group Member object returned for Groups; it is interpreted at one Group Member record per row; classification values are Databricks-returned labels rather than a universal taxonomy.

Value

Developer identifier: groups.members.valueValue records the SCIM ID of the member (user, service principal, or group). It is needed to attribute this Groups row to the returned person, account, or organization reference.

Enables: attribute the Groups row to the returned person or account and match the exact value value where it recurs in Databricks.
Interpretation: Databricks reports this value on the Group Member object returned for Groups; it is interpreted at one Group Member record per row.

​How It Works

​Token Request

​Using the Access Token

​Metadata & identity

​User activity

​Data streams

​Source permissions

​Databricks

​What You’ll Need

​Step 1: Create a service principal

​Step 2: Assign the service principal to the workspace

​Step 3: Generate an OAuth secret

​Step 4: Grant SQL warehouse access

​Step 5: Grant Unity Catalog metadata access

​Step 6: Grant system table access (user activity data streams)

​Step 7: Enter values in Parable

​Step 8: Test connection

​Databricks

​Permission layers

​Grants by default data stream

​System table grants (reference)

​Verify permissions

​Large workspace notes (tables data stream)

​Security review notes

How It Works

Token Request

Using the Access Token

Metadata & identity

User activity

Data streams

Source permissions

Databricks

What You’ll Need

Step 1: Create a service principal

Step 2: Assign the service principal to the workspace

Step 3: Generate an OAuth secret

Step 4: Grant SQL warehouse access

Step 5: Grant Unity Catalog metadata access

Step 6: Grant system table access (user activity data streams)

Step 7: Enter values in Parable

Step 8: Test connection

Databricks

Permission layers

Grants by default data stream

System table grants (reference)

Verify permissions

Large workspace notes (`tables` data stream)

Security review notes