Trailox for Databricks
Trace Databricks activity across identities, jobs and tables.
Understand access across workspaces, jobs, service principals, catalogs and tables. Detect behavioral changes and investigate historical activity across every workspace.
Unusual read by a service principal
Databricks
03:12 UTCIllustrative
- Identity
- etl-nightly, service principal
- Table
- prod.finance.payments, first read
- Timing
- Outside the job's scheduled run window
- Volume
- Far above this job's history
Next step: Disable the service principal, then use the same record to see what it read.
What it shows
What Trailox shows in Databricks
- Every event, attributed: the user or service principal, and the job or notebook behind it.
- Table access: reads and writes on your tables.
- Bulk reads: jobs that read far more than their own history.
- Access history: a table's complete access history over time.
Detections
Behavioral detections for Databricks
What it catches
- Stolen tokens and logins that still work
- Data copied out of your lakehouse
- Jobs, service principals and AI agents reading outside their task
- Insider misuse by a valid user
FAQ
Questions buyers ask
Does Trailox read my Databricks tables?
No. Trailox reads access logs and metadata only. Your data is never read.
Does anything run inside my clusters or jobs?
No. Nothing is deployed inside clusters or jobs.
Can Trailox flag bulk reads?
Yes. Trailox flags jobs that read far more data than their own history.
How do we start?
With a free 14-day Data Access Review. Read-only. First findings in 48 hours.
Start with proof,
not a pitch.
Free 14-day Data Access Review. Read-only. First findings in 48 hours.