diff --git a/_data/cont3xt/databricks.yml b/_data/cont3xt/databricks.yml
new file mode 100644
index 0000000..a69824b
--- /dev/null
+++ b/_data/cont3xt/databricks.yml
@@ -0,0 +1,44 @@
+name: "Databricks Integration"
+before: |
+ (Since 5.5.1) Cont3xt can query Databricks for results.
+
+ Create a [databricks:NAME]
section where NAME is a unique name for all integrations
+
+settings:
+ - key: name
+ value: section name
+ text: The friendly name to show the user in the UI
+
+ - key: icon
+ value: icon for integration in UI
+ text: Path to icon to use in UI
+
+ - key: host
+ value: REQUIRED
+ text: The Databricks hostname (usually something like *******.databricks.com)
+
+ - key: token
+ value: REQUIRED
+ text: The Databricks token (usually starts with "dapi")
+
+ - key: path
+ value: REQUIRED
+ text: The Databricks path (usually something like /sql/1.0/warehouses/******)
+
+ - key: statement
+ value: REQUIRED
+ text: The query statement to run against Databricks. For non periodic queries the named parameter SEARCHTERM will be replaced with the key. (e.g. SELECT * FROM catalog.schema.table WHERE ip = SEARCHTERM)
+
+after: |
+
+ Example config that will query Databricks for all the IPs that match. +
++ [databricks:users] + itypes = ip + name = DataBricks Users + host = abc-123456-789.cloud.databricks.com + path = /sql/1.0/warehouses/abcxyz125789 + token = THESUPERSECRETTOKEN + statement=SELECT * FROM catalog.schema.table WHERE ip = SEARCHTERM +diff --git a/_data/wise/databricks.yml b/_data/wise/databricks.yml index 7abbe81..df0c4fa 100644 --- a/_data/wise/databricks.yml +++ b/_data/wise/databricks.yml @@ -16,11 +16,11 @@ settings: - key: host value: REQUIRED - text: The Databricks hostname + text: The Databricks hostname (usually something like *******.databricks.com) - key: token value: REQUIRED - text: The Databricks token + text: The Databricks token (usually starts with "dapi") - key: keyPath value: REQUIRED @@ -32,11 +32,11 @@ settings: - key: path value: REQUIRED - text: The Databricks path + text: The Databricks path (usually something like /sql/1.0/warehouses/******) - key: query value: REQUIRED - text: The query to run against Databricks. For non periodic queries the named parameter SEARCHTERM will be replaced with the key. + text: The query to run against Databricks. For non periodic queries the named parameter SEARCHTERM will be replaced with the key. (e.g. SELECT * FROM catalog.schema.table WHERE ip = SEARCHTERM) - key: mergeQuery value: EMPTY @@ -50,11 +50,11 @@ after: | [databricks:users] type = ip format = json - host = databricks.example.com - path = /sql/2.0/warehouses/vpndata - token = THETOKEN + host = abc-123456-789.cloud.databricks.com + path = /sql/1.0/warehouses/abcxyz125789 + token = THESUPERSECRETTOKEN periodic=60 - query= + query=SELECT * FROM catalog.schema.table WHERE ip = SEARCHTERM keyPath=vpn_ip fields=field:user;shortcut:user