To determine who started a job run in Databricks, you can use the Audit Logs feature by enabling workspace-level events and analyzing the runStarted events. Look for the userIdentity field within these logs, which identifies whether the run was triggered by a user or a service principal (e.g., using curl). Ensure that the audit log retention period and permissions are properly configured in AWS CloudTrail or your logging system to capture these details. If userIdentity is unclear, cross-check with Databricks job execution details or enable job tags for easier tracking.