Security operations sees an unusual principal enumerating many Unity Catalog schemas overnight. Which artifact should they review first?

Unity Catalog audit logs covering the anomalous schema enumeration activity are the artifact security operations should review first when an unusual principal enumerates many schemas overnight. Audit logs provide the authoritative timeline of who listed or accessed which securables, which is the starting point for a municipal security investigation of suspicious catalog reconnaissance.

Unity Catalog lineage graphs covering the anomalous schema enumeration activity fail by concept because lineage maps table relationships, not who listed or accessed which securables overnight. Cluster Spark driver logs covering the anomalous schema enumeration activity have no bearing on Unity Catalog schema enumeration because they record Spark execution output, not principal access. Workspace query history tables covering the anomalous schema enumeration activity similarly lack the authoritative principal/action/object audit telemetry for overnight enumeration.

Exam caveat: Audit logs are the investigative source of truth for access anomalies; they do not by themselves block further enumeration—privilege hardening and ABAC may follow once the principal and scope are understood. Correlate log timestamps with identity provider signals if the principal looks compromised. Do not confuse Cluster Spark driver logs covering the anomalous schema enumeration activity with UC object-access audit trails when the symptom is schema enumeration.

Operational check: Query audit logs for the overnight window filtered to the unusual principal and schema-list or similar actions, enumerate which catalogs and schemas were touched, disable or constrain the principal if activity is unauthorized, and open a formal incident record for the civic security team.