---
title: >-
  Databricks workspaces should send required diagnostic log categories to a
  destination
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Databricks workspaces should send
  required diagnostic log categories to a destination
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Databricks workspaces should send required diagnostic log categories to a destination
 
## Description{% #description %}

Azure Databricks workspaces should send the `accounts`, `Filesystem`, `clusters`, `notebook`, and `jobs` diagnostic log categories to a Log Analytics workspace, storage account, event hub, or partner solution. These categories record account activity, file system access, cluster changes, notebook runs, and job runs, which you need to investigate security incidents.

This rule passes when diagnostic settings with a destination enable each required category, or enable the `allLogs` category group. The `audit` category group does not count, because Microsoft does not document which Databricks categories it includes, and the separate `dbfs` category does not count as `Filesystem`. Diagnostic log delivery requires the Premium pricing tier.

## Remediation{% #remediation %}

Create a diagnostic setting on the workspace that sends the required categories to a destination. See [Configure diagnostic log delivery](https://learn.microsoft.com/en-us/azure/databricks/admin/account-settings/audit-log-delivery).

## References{% #references %}

- [Configure diagnostic log delivery](https://learn.microsoft.com/en-us/azure/databricks/admin/account-settings/audit-log-delivery)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)