What this audit checks
Authentication & access
- Workspace URL host resolves to a valid Databricks region (.cloud.databricks.com / .azuredatabricks.net / .gcp.databricks.com)
- Personal Access Token authenticates and is not expired against /api/2.0/clusters/list
- Token / service principal has READ permission on warehouses, clusters and jobs (no 403 on probe calls)
- HTTP Path resolves to a real warehouse (
/sql/1.0/warehouses/<id>) or clusters endpoint
Connection & availability
- Workspace responds and at least one cluster or SQL warehouse is in a RUNNING state
- Active SQL warehouses reachable via /api/2.0/sql/warehouses with no STOPPED warehouse expected to be serving
- SQL query error rate over the last 5m below 1% (no widespread query failures)
- Rate-limit headroom healthy - not hitting 429 on /api/2.1/jobs/runs/list against the 600/min workspace ceiling
Query performance
- SQL warehouse query latency p95 below 5000ms over the rolling 5m window
- SQL warehouse query latency p99 below 30000ms over the rolling 5m window
- Slow-query rate below 5% from /api/2.0/sql/history/queries (duration over the slow threshold)
- Top 10 slowest queries identified by query_id with duration_ms and rows_examined for tuning
Replication & lag
- DLT / Workflows pipeline lag (time since last successful run) below the pipeline’s expected_interval
- No data pipeline in BROKEN or STOPPED state from /api/2.0/pipelines status distribution
- Scheduled job success rate over the last 24h at or above 95% from /api/2.1/jobs/runs/list
- No failed-job burst - fewer than 5 runs with result_state FAILED or TIMEDOUT in the last 1h
Storage & capacity
- SQL warehouse saturation below 90% (active sessions vs max_num_clusters x concurrency)
- Avg cluster CPU utilisation between 30% and 90% - flag under-utilised (right-size down) or saturated (scale up)
- Idle cluster DBU wasted over 24h below 10% of total DBU (auto-termination firing on idle clusters)
- DBU burned over 24h within band - not +50% week-over-week without proportional workload growth
Backups & durability
- Last Delta Lake OPTIMIZE / VACUUM on the largest tables ran within 72h
- Delta Time Travel retention at or above the default 7 days for recovery coverage
- Long-running jobs (over 1h past expected duration) flagged as cost-runaway / stuck-write risk
- Cross-platform: SQL slow-query or pipeline-lag burst correlated with sibling commerce checkout drop (revenue at risk)
Severity thresholds
Data sources
GET https://{workspace}.cloud.databricks.com/api/2.0/clusters/list- Cluster inventory, state, DBR version, region - auth probe + capacityGET https://{workspace}.cloud.databricks.com/api/2.0/sql/warehouses- SQL warehouse list, size, sessions, max concurrency - saturationGET https://{workspace}.cloud.databricks.com/api/2.0/sql/history/queries- Query history with duration, read_rows, error state - latency + slow-query rateGET https://{workspace}.cloud.databricks.com/api/2.1/jobs/runs/list- Job / workflow runs - success rate, failures, pipeline lag (replication)GET https://{workspace}.cloud.databricks.com/api/2.0/pipelines- Delta Live Tables pipeline status distribution + lagGET https://{workspace}.cloud.databricks.com/api/2.0/billable-usage/download- DBU burn by cluster / user / workflow - cost anomaly (account-level auth)