diff --git a/_data/cont3xt/databricks.yml b/_data/cont3xt/databricks.yml new file mode 100644 index 0000000..a69824b --- /dev/null +++ b/_data/cont3xt/databricks.yml @@ -0,0 +1,44 @@ +name: "Databricks Integration" +before: | + (Since 5.5.1) Cont3xt can query Databricks for results. + + Create a [databricks:NAME] section where NAME is a unique name for all integrations + +settings: + - key: name + value: section name + text: The friendly name to show the user in the UI + + - key: icon + value: icon for integration in UI + text: Path to icon to use in UI + + - key: host + value: REQUIRED + text: The Databricks hostname (usually something like *******.databricks.com) + + - key: token + value: REQUIRED + text: The Databricks token (usually starts with "dapi") + + - key: path + value: REQUIRED + text: The Databricks path (usually something like /sql/1.0/warehouses/******) + + - key: statement + value: REQUIRED + text: The query statement to run against Databricks. For non periodic queries the named parameter SEARCHTERM will be replaced with the key. (e.g. SELECT * FROM catalog.schema.table WHERE ip = SEARCHTERM) + +after: | +

+ Example config that will query Databricks for all the IPs that match. +

+
+    [databricks:users]
+    itypes = ip
+    name = DataBricks Users
+    host = abc-123456-789.cloud.databricks.com
+    path = /sql/1.0/warehouses/abcxyz125789
+    token = THESUPERSECRETTOKEN
+    statement=SELECT * FROM catalog.schema.table WHERE ip = SEARCHTERM
+  
diff --git a/_data/wise/databricks.yml b/_data/wise/databricks.yml index 7abbe81..df0c4fa 100644 --- a/_data/wise/databricks.yml +++ b/_data/wise/databricks.yml @@ -16,11 +16,11 @@ settings: - key: host value: REQUIRED - text: The Databricks hostname + text: The Databricks hostname (usually something like *******.databricks.com) - key: token value: REQUIRED - text: The Databricks token + text: The Databricks token (usually starts with "dapi") - key: keyPath value: REQUIRED @@ -32,11 +32,11 @@ settings: - key: path value: REQUIRED - text: The Databricks path + text: The Databricks path (usually something like /sql/1.0/warehouses/******) - key: query value: REQUIRED - text: The query to run against Databricks. For non periodic queries the named parameter SEARCHTERM will be replaced with the key. + text: The query to run against Databricks. For non periodic queries the named parameter SEARCHTERM will be replaced with the key. (e.g. SELECT * FROM catalog.schema.table WHERE ip = SEARCHTERM) - key: mergeQuery value: EMPTY @@ -50,11 +50,11 @@ after: | [databricks:users] type = ip format = json - host = databricks.example.com - path = /sql/2.0/warehouses/vpndata - token = THETOKEN + host = abc-123456-789.cloud.databricks.com + path = /sql/1.0/warehouses/abcxyz125789 + token = THESUPERSECRETTOKEN periodic=60 - query= + query=SELECT * FROM catalog.schema.table WHERE ip = SEARCHTERM keyPath=vpn_ip fields=field:user;shortcut:user