Kyberis for Databricks

​

What you get

• A helper package (kyberis_databricks) — credential loading from Databricks secret scopes or app environment variables, short-lived bearer token handling, and batched enrichment helpers (assess_iocs, resolve_entities) that return DataFrame-ready rows with a fixed schema. Pure standard library.
• A Databricks App — a Streamlit workspace app for interactive IOC and entity investigation: single lookups, paste-a-list batch enrichment with CSV export, and intel search.
• Example notebooks — IOC batch enrichment into a Delta table, and environment-driven CVE prioritization.
• A vendored API client — the shared Kyberis API client, dependency-free by design so vendoring is safe.

​

Guides

​

Quickstart

​

Jobs and clusters, via Databricks Marketplace

%pip install /Volumes/<catalog>/kyberis/releases/kyberis_databricks-1.0.0-py3-none-any.whl
dbutils.library.restartPython()

​

Notebooks and jobs, via a Git folder

1. Add the repository as a Databricks Git folder (Workspace → Create → Git folder).
2. Create a secret scope holding your API key — see Credential setup:
   databricks secrets create-scope kyberis
   databricks secrets put-secret kyberis kyberis-api-key-id
   databricks secrets put-secret kyberis kyberis-api-key-secret
   
3. Open notebooks/01_ioc_batch_enrichment.py and run it. The notebooks import src/ and vendor/ from the Git folder directly — no wheel install needed.

​

Databricks App

databricks apps create kyberis-threat-intelligence
databricks sync . /Workspace/Users/<you>/kyberis-databricks
databricks apps deploy kyberis-threat-intelligence \
  --source-code-path /Workspace/Users/<you>/kyberis-databricks

​

Support