detect-databricks-token-creation

Detect creation of Databricks personal access tokens (PATs) on a workspace. Reads OCSF 1.8 API Activity (class 6003) records carrying `metadata.product.vendor_name == "Databricks"`, `api.operation == "tokens/create"`, an `actor.user.uid` (or `email_addr`), and `unmapped.databricks.workspace_id`, and emits one OCSF 1.8 Detection Finding (class 2004) per successful token issuance, tagged with MITRE ATT&CK T1098.001 (Additional Cloud Credentials). Once a PAT exists it can be used for headless API access without an interactive login. Use when the user mentions "Databricks PAT created", "Databricks token issued", "T1098.001 in Databricks", or "additional cloud credentials in Databricks". Do NOT use on raw Databricks audit-log JSON before OCSF normalization, as a posture-at-rest token inventory or age check, or as a generic credential-issuance detector for non-Databricks platforms.