databricks-industry-solutions
diff --git a/‎docs/sat/docs/functionality/cluster-secrets-scanning.mdx‎
Lines changed: 169 additions & 0 deletions b/‎docs/sat/docs/functionality/cluster-secrets-scanning.mdx‎
Lines changed: 169 additions & 0 deletions
diff --git a/‎docs/sat/docs/functionality/executive-dashboard.mdx‎
Lines changed: 169 additions & 0 deletions b/‎docs/sat/docs/functionality/executive-dashboard.mdx‎
Lines changed: 169 additions & 0 deletions
@@ -0,0 +1,169 @@
+---
+sidebar_position: 4
+---
+import useBaseUrl from '@docusaurus/useBaseUrl';
+import Admonition from '@theme/Admonition';
+
+# Cluster Configuration Secrets Scanning
+
+<Admonition type="info" title="Version 0.6.0 Feature">
+SAT's secret scanning capability—previously limited to notebooks—now extends to cluster configurations.
+</Admonition>
+
+## Overview
+
+Developers sometimes hardcode credentials in cluster environment variables during testing and forget to remove them. These secrets can persist for months, accessible to anyone who can view cluster configurations. SAT's Cluster Configuration Secrets Scanning helps you identify and remediate these security risks.
+
+## What It Does
+
+SAT scans `spark_env_vars` in cluster configurations for hardcoded credentials using TruffleHog with 800+ detector patterns, including:
+
+- **AWS credentials**: Access keys, secret keys, session tokens
+- **Azure secrets**: Service principal keys, storage account keys
+- **GCP credentials**: Service account keys, API keys
+- **GitHub tokens**: Personal access tokens, OAuth tokens
+- **API keys**: Stripe, Slack, SendGrid, and other service API keys
+- **Database passwords**: Connection strings with embedded credentials
+- **Private keys**: SSH keys, RSA keys, and other cryptographic material
+- **Databricks-specific tokens**: DKEA, DAPI, DOSE tokens
+
+## Why It Matters
+
+Hardcoded credentials in cluster configurations pose significant security risks:
+
+- **Persistent Exposure**: Secrets remain in cluster configs until explicitly removed
+- **Broad Access**: Anyone with cluster view permissions can see these secrets
+- **Compliance Violations**: Hardcoded secrets violate security best practices and compliance requirements
+- **Attack Surface**: Exposed credentials can be used to access cloud resources, databases, and external services
+
+## How It Works
+
+1. **Data Collection**: SAT scans all cluster configurations in your workspaces
+2. **Pattern Detection**: TruffleHog analyzes `spark_env_vars` using 800+ detector patterns
+3. **Correlation**: Results are correlated with notebook scan findings for comprehensive secret exposure analysis
+4. **Reporting**: Findings are displayed in the SAT Dashboard and stored in the `clusters_secret_scan_results` table
+
+## Viewing Results
+
+Cluster secret scan results are available in multiple places:
+
+### SAT Dashboard
+
+The Secret Scanner Dashboard displays cluster secret findings alongside notebook findings, providing a comprehensive view of secret exposure across your environment.
+
+<div className='bg-gray-100 p-4 rounded-lg mb-6'>
+ <img src={useBaseUrl('/img/secret_scanner_dashboard.png')} alt="Secret Scanner Dashboard" />
+</div>
+
+### Database Tables
+
+Results are stored in the `clusters_secret_scan_results` table within your SAT schema:
+
+- **Cluster ID**: Identifier of the cluster with exposed secrets
+- **Cluster Name**: Human-readable cluster name
+- **Environment Variable**: The variable name containing the secret
+- **Detector**: Type of secret detected (e.g., "AWS Secret Key")
+- **Severity**: Risk level (HIGH, MEDIUM, LOW)
+- **Workspace**: Workspace where the cluster was found
+- **Scan Timestamp**: When the scan was performed
+
+## Example Finding
+
+```
+Cluster: dev-team-cluster
+Environment Variable: AWS_SECRET_ACCESS_KEY
+Detector: AWS Secret Key
+Severity: HIGH
+Recommendation: Move to Databricks Secrets
+```
+
+## Remediation
+
+<Admonition type="warning" title="Remediation Required">
+High-severity findings should be remediated immediately by removing hardcoded secrets and moving them to Databricks Secrets.
+</Admonition>
+
+### Recommended Approach
+
+1. **Remove Hardcoded Secrets**: Delete the secret from the cluster's `spark_env_vars` configuration
+2. **Use Databricks Secrets**: Store credentials in Databricks Secrets (Databricks-backed or customer-managed)
+3. **Reference Secrets**: Update cluster configuration to reference secrets using `{{secrets/scope/key}}` syntax
+4. **Verify Access**: Ensure the cluster has appropriate permissions to access the secret scope
+
+### Example: Migrating to Databricks Secrets
+
+**Before (Insecure):**
+```json
+{
+  "spark_env_vars": {
+    "AWS_SECRET_ACCESS_KEY": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+  }
+}
+```
+
+**After (Secure):**
+```json
+{
+  "spark_env_vars": {
+    "AWS_SECRET_ACCESS_KEY": "{{secrets/aws-credentials/secret-key}}"
+  }
+}
+```
+
+## Configuration
+
+Secret scanning behavior can be configured via the `trufflehog_detectors.yaml` file located in the `configs` folder:
+
+- **days_back**: Controls how far back to search for modified clusters
+  - Set to `1` to scan clusters modified in the last day (default)
+  - Set to `7` to scan clusters modified in the last week
+  - Set to `0` to scan **ALL clusters** in the workspace (no time filter)
+- **page_size**: Number of clusters to process per API page (default: 50)
+- **custom detectors**: Add custom regex patterns to detect organization-specific secret formats
+
+### Firewall Allowlist Requirements
+
+If your environment uses firewalls, you may need to allowlist the following GitHub domains to ensure secret scanning can download TruffleHog and access required resources:
+
+<Admonition type="warning" title="Firewall Configuration">
+If you encounter connection issues during secret scanning, ensure your firewall allows outbound connections to the following domains:
+</Admonition>
+
+Add the following URLs to your firewall allowlist:
+
+- `raw.githubusercontent.com`
+- `github.com`
+- `token.actions.githubusercontent.com`
+- `release-assets.githubusercontent.com`
+
+## Best Practices
+
+<Admonition type="tip" title="Regular Scanning">
+Run cluster secret scans regularly (weekly or bi-weekly) to catch newly introduced secrets before they become security risks.
+</Admonition>
+
+<Admonition type="tip" title="Automated Workflows">
+Consider implementing automated workflows to alert security teams when high-severity secrets are detected in cluster configurations.
+</Admonition>
+
+<Admonition type="tip" title="Developer Training">
+Educate developers on using Databricks Secrets instead of hardcoding credentials. Include this in onboarding and security training.
+</Admonition>
+
+<Admonition type="warning" title="False Positives">
+Some patterns may trigger false positives. Review findings carefully and adjust detector patterns if needed.
+</Admonition>
+
+## Integration with Notebook Scanning
+
+Cluster Configuration Secrets Scanning complements SAT's existing notebook secret scanning:
+
+- **Comprehensive Coverage**: Identifies secrets in both notebooks and cluster configurations
+- **Correlated Analysis**: Correlates findings to identify patterns of secret exposure
+- **Unified Reporting**: All secret findings are displayed in a single dashboard
+
+## Learn More
+
+- [Usage Guide](/docs/usage) - Instructions on running SAT workflows and viewing results
+- [Permissions Analysis](../permissions-analysis) - Understand who can access cluster configurations
+- [General Dashboard](../general-dashboard) - View comprehensive security findings
@@ -0,0 +1,169 @@
+---
+sidebar_position: 2
+---
+import useBaseUrl from '@docusaurus/useBaseUrl';
+import Admonition from '@theme/Admonition';
+
+# Executive Dashboard
+
+The **Executive Dashboard** is a streamlined, high-level view designed for stakeholders and executives who need a quick overview of the security posture without getting into technical details.
+
+<div className='bg-gray-100 p-4 rounded-lg mb-6'>
+ <img src={useBaseUrl('/img/executive_dashboard.png')} alt="Executive Dashboard" />
+</div>
+
+## Overview
+
+In addition to the comprehensive SAT dashboard, an **Executive Dashboard** is also provided. This view consolidates key findings from the complete dashboard and presents them in an easy-to-digest format that's perfect for leadership and business stakeholders.
+
+<Admonition type="tip" title="Databricks One Integration">
+You can use **Databricks One** to access and share the SAT dashboards across your organization, making it easier to distribute security insights to stakeholders.
+</Admonition>
+
+## What Leadership Can Do
+
+The Executive Dashboard enables leadership to:
+
+- ✅ **Quickly understand** the overall security health of Databricks deployments
+- ✅ **Identify critical security issues** that require immediate attention
+- ✅ **Track security improvements** over time
+- ✅ **Make informed decisions** about security investments and priorities
+
+This executive-level view complements the detailed technical dashboard, ensuring that both technical teams and business stakeholders have access to the security insights they need.
+
+## Key Metrics
+
+The Executive Dashboard focuses on high-level metrics and trends:
+
+### Security Health Score
+
+A consolidated view of overall security posture across all workspaces, typically displayed as:
+- Overall security score or rating
+- Trend indicators (improving, stable, declining)
+- Comparison across workspaces or time periods
+
+### Critical Issues Summary
+
+High-level summary of critical security findings:
+- Count of high-severity issues
+- Count of medium-severity issues
+- Count of low-severity issues
+- Trend analysis showing improvement or regression
+
+### Workspace Overview
+
+Summary information about monitored workspaces:
+- Number of workspaces analyzed
+- Workspace health status
+- Geographic distribution
+- Cloud provider breakdown
+
+### Compliance Status
+
+High-level compliance indicators:
+- Overall compliance score
+- Key compliance categories status
+- Audit readiness indicators
+
+## Benefits for Different Audiences
+
+### For Executives
+
+- **Time-efficient**: Get security insights in minutes, not hours
+- **Actionable**: Clear priorities and recommendations
+- **Trend-focused**: Understand security posture over time
+- **Risk-aware**: Identify critical issues requiring attention
+
+### For Security Leadership
+
+- **Strategic view**: Understand security posture across the organization
+- **Resource planning**: Identify areas needing investment
+- **Compliance tracking**: Monitor compliance status and trends
+- **Stakeholder communication**: Share security status with business leaders
+
+### For Business Stakeholders
+
+- **Non-technical**: Easy to understand without deep technical knowledge
+- **Business-aligned**: Focus on business impact and risk
+- **Transparent**: Clear visibility into security posture
+- **Confidence-building**: Demonstrate proactive security management
+
+## Dashboard Configuration
+
+The Executive Dashboard follows the same configuration process as the General Dashboard:
+
+1. Click on the dashboard and in the top right, click on the **"Share"** button.
+2. Click on the cogwheel icon and select **"Assign new owner"**. Choose the new owner of the dashboard.
+3. Click on the **"Published"** icon next to the name of the dashboard, and switch to the **"Draft"** version. Click on the **"Publish"** button.
+   - Choose from one of the two credential options:
+     - **Embed credentials (default):** All viewers run queries using the owner's credentials and compute.
+     - **Don't embed credentials:** Each viewer must have access to the workspace and associated data to view the dashboard.
+       > We recommend using this option for more secure access control.
+4. The dashboard can be shared with other team members by clicking the **"Share"** button from the **"Published"** mode.
+
+<Admonition type="tip" title="Sharing Configuration">
+Consider creating different sharing groups for executives vs. technical teams. Executives may only need view access, while technical teams may need access to drill down into details.
+</Admonition>
+
+## When to Use
+
+### Regular Reviews
+
+Use the Executive Dashboard for:
+- **Weekly security briefings** with leadership
+- **Monthly security reviews** with stakeholders
+- **Quarterly business reviews** including security posture
+- **Board presentations** on security status
+
+### Decision Making
+
+The Executive Dashboard supports:
+- **Budget planning** for security improvements
+- **Resource allocation** for security initiatives
+- **Risk assessment** for business decisions
+- **Compliance reporting** to auditors and regulators
+
+### Communication
+
+Share the Executive Dashboard to:
+- **Demonstrate progress** on security initiatives
+- **Highlight achievements** in security improvements
+- **Raise awareness** of security priorities
+- **Build confidence** in security posture
+
+## Relationship to General Dashboard
+
+The Executive Dashboard and General Dashboard work together:
+
+| **Executive Dashboard** | **General Dashboard** |
+|-------------------------|----------------------|
+| High-level metrics | Detailed findings |
+| Business-focused | Technical-focused |
+| Strategic view | Operational view |
+| Quick overview | Deep dive analysis |
+| For leadership | For technical teams |
+
+<Admonition type="info" title="Dashboard Relationship">
+Both dashboards use the same underlying data, ensuring consistency. The Executive Dashboard provides the "what" and "why," while the General Dashboard provides the "how" and "where."
+</Admonition>
+
+## Best Practices
+
+<Admonition type="tip" title="Regular Updates">
+Ensure the Executive Dashboard is updated regularly (weekly or bi-weekly) to provide current security insights to leadership.
+</Admonition>
+
+<Admonition type="tip" title="Customization">
+Consider customizing the Executive Dashboard to highlight metrics most relevant to your organization's security priorities and compliance requirements.
+</Admonition>
+
+<Admonition type="tip" title="Dashboard Usage">
+Use both dashboards together: Executive Dashboard for high-level status, General Dashboard for detailed remediation.
+</Admonition>
+
+## Learn More
+
+- [General Dashboard](../general-dashboard) - Detailed technical dashboard
+- [Permissions Analysis](../permissions-analysis) - Graph-based access analysis
+- [Cluster Secrets Scanning](../cluster-secrets-scanning) - Detect exposed credentials
+- [Usage Guide](/docs/usage) - Instructions on running SAT workflows and accessing dashboards