Databricks SQL Addition Okta Queries

[zaynahsmith-dasilva]

Background

Changes

• Added a databricks sql YAML key to the existing SQL queries within the Okta log type.

Testing

[cursor]

PR Summary

Medium Risk
Medium risk because this adds alternate SQL implementations for security detections and threat-hunting queries, where dialect differences could affect alert results. Existing Snowflake logic is largely preserved.

Overview
Adds DatabricksQuery definitions across Okta saved and scheduled queries, while converting existing Query fields to SnowflakeQuery. The new Databricks SQL ports adapt nested-field access, array functions, length functions, collection aggregation, and lateral explode syntax for Databricks compatibility.

Also updates the Okta AD Agent z-score query to use panther_lookups.public.okta_ad_baseline_90d instead of the previous lookup table name.

^{Reviewed by Cursor Bugbot for commit ea0411f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ea0411f. Configure here.}