New feature
GA
Enhanced security monitoring
Enhanced security monitoring is a Databricks data governance capability, introduced June 2022.
A workspace setting that swaps classic compute onto a CIS-hardened Ubuntu Advantage disk image and adds antivirus, file integrity, and vulnerability monitoring agents whose findings land in the audit logs.
- The antivirus agent scans the whole host OS filesystem and the Databricks Runtime container filesystem for viruses once a day, and you cannot switch the pre-installed agents off - they are baked into the disk image.
- The audit log schema quietly names the tools doing the work: file integrity events arrive from a service called capsule8-alerts-dataplane and antivirus events from clamAVScanService-dataplane.
- Vulnerability scan reports are emailed to every workspace admin each time Databricks ships a new AMI - on Azure that only became automatic in July 2024, before which admins had to ask for them.
Limitations: Applies only to classic compute (clusters and non-serverless SQL warehouses) - serverless resources get no extra monitoring; the workspace must be on the Enterprise pricing tier; the pre-installed agents cannot be disabled; and turning it on bills the Enhanced Security and Compliance add-on.
Open in REbricked →- Category
- Data governance
- Also known as
- ESM, Enhanced Security Monitoring
- Verified
- 2026-09-11