Databricks Functions

PantherFlow Databricks functions

PantherFlow for Databricks is in closed beta starting with Panther version 1.120. Please share any bug reports and feature requests with your Panther support team.

databricks.func()

databricks.func(func_name: string [, arg1: any, ... ]) -> any

Call any function in Databricks. This function simply acts as a passthrough.

Limitations

• The arrays functions are currently limited to underlying ARRAY<STRING> type data.

• Databricks requires explicit typing at SQL query compilation time. Queries that use unspecified VARIANT type data may cause errors.

Example:

panther_logs.aws_alb
| project inCidr=databricks.func("ip_cidr_contains", "10.32.0.0/16", clientIp)