Rule
A Lakewatch detection rule: a query that evaluates ingested data and generates a signal for each match. Each rule is a securable in a Unity Catalog schema.
Rule object
A Lakewatch detection rule: a query that evaluates ingested data and generates a signal for each match. Each rule is a securable in a Unity Catalog schema.
- namestringBetaIDImmutable
Resource name, in the form
rules/{rule_id}. Assigned by the server on create; required on update.
- rule_idstringBetaOutput only
Unity Catalog securable UUID of the rule, and the last segment of
name. Never changes, including when the rule's catalog or schema is renamed.
- catalog_namestringBetaImmutable
Name of the Unity Catalog catalog that contains the rule. Required. Cannot be changed after creation. Reads return the value as supplied; the catalog's current name is reported in
effective_catalog_name.
- schema_namestringBetaImmutable
Name of the Unity Catalog schema that contains the rule. Required. Cannot be changed after creation. Reads return the value as supplied; the schema's current name is reported in
effective_schema_name.
- effective_catalog_namestringBetaOutput only
Current name of the Unity Catalog catalog that contains the rule. Reflects catalog renames, which do not change
catalog_name. Unset until resolved.
- effective_schema_namestringBetaOutput only
Current name of the Unity Catalog schema that contains the rule. Reflects schema renames, which do not change
schema_name. Unset until resolved.
- rule_namestringBetaImmutable
Name of the rule within its Unity Catalog schema. Required. Cannot be changed after creation. Reads return the value as supplied; the current UC name is reported in
effective_rule_name.
- effective_rule_namestringBetaOutput only
Current UC leaf name of the rule (server-owned). Tracks UC renames so callers can observe the live name without having to update the client-owned
rule_name; unset until resolved.
- descriptionstringBeta
Free-form description.
- versionint64BetaOutput only
Monotonic version, bumped on each update. Informational; use
etagfor optimistic concurrency.
- create_timestringBetaOutput only
Time the rule was created.
- update_timestringBetaOutput only
Time the rule was last updated.
- created_byobjectBetaOutput only
Principal that created the rule.
Show child attributesHide child attributes
- idstringBeta
User / service-principal ID.
- principal_typestringBeta
Whether this principal is a regular user, service principal, or system principal.
REGULAR_USERSERVICE_PRINCIPALSYSTEM_USER
- emailstringBeta
Email (regular users only).
- display_namestringBeta
Display name (user or SP name).
- updated_byobjectBetaOutput only
Principal that last updated the rule.
Show child attributesHide child attributes
- idstringBeta
User / service-principal ID.
- principal_typestringBeta
Whether this principal is a regular user, service principal, or system principal.
REGULAR_USERSERVICE_PRINCIPALSYSTEM_USER
- emailstringBeta
Email (regular users only).
- display_namestringBeta
Display name (user or SP name).
- etagstringBetaOutput only
Opaque entity tag for optimistic concurrency. Content-version ETags change on user edits and remain stable across runtime status updates.
- annotationsobjectBeta
Free-form client-managed key/value annotations.
- ownerobjectBetaOutput only
Unity Catalog owner of the rule. Assigned by the server. Populated by
GetRule.Show child attributesHide child attributes
- idstringBeta
User / service-principal ID.
- principal_typestringBeta
Whether this principal is a regular user, service principal, or system principal.
REGULAR_USERSERVICE_PRINCIPALSYSTEM_USER
- emailstringBeta
Email (regular users only).
- display_namestringBeta
Display name (user or SP name).
- run_as_principalstringBeta
The principal whose identity this rule's job runs as, given as a user email or service-principal application ID. When supplied on create/update, Lakewatch resolves the principal, records it on the rule, and creates the delegation to run as that principal — the requester must be authorized to delegate to it, or the request is rejected. When omitted on create, the requester's own identity is used. An update whose mask does not include
run_as_principalkeeps the current identity, and the requester must still be authorized to delegate to it; an editor who is not must supply a run_as_principal they can delegate to (for example, their own identity), or clear it, either of which reassigns the rule. An update whose mask includesrun_as_principalbut supplies no value clears it: the rule then runs as the requester, exactly as when it is omitted on create. Reads return the value as supplied; the identity the rule runs as is reported ineffective_run_as_principal.
- effective_run_as_principalstringBetaOutput only
The identity this rule's job runs as: the resolved
run_as_principal, or the requester's identity when it was omitted on create or cleared on update. The value is a user email or service-principal application ID, falling back to the numeric principal ID if that identity can no longer be resolved. Populated on single-rule reads (get/create/update); list responses omit it.
- categorystringBeta
Free-form rule category.
- severitystringBeta
Free-form severity label, such as
Informational,Medium,High, orCritical.
- fidelitystringBeta
Signal quality for this rule.
FIDELITY_DEVELOPMENTFIDELITY_INVESTIGATIVEFIDELITY_MEDIUMFIDELITY_HIGH
- objectivestringBeta
Long-form description of what this rule detects.
- mitrearray of objectBeta
Up to 64 MITRE ATT&CK mappings, producing at most 192 flattened alert tags.
Show child attributesHide child attributes
- taxonomystringBeta
Structured framework that organizes adversary behaviors, such as
mitre-attack.
- tacticstringBeta
Adversary objective during this attack, such as
Command and Control.
- technique_idstringBeta
MITRE technique ID, such as
T1078.
- techniquestringBeta
Human-readable MITRE technique name.
- sub_technique_idstringBeta
MITRE sub-technique ID, such as
T1078.001.
- sub_techniquestringBeta
Human-readable MITRE sub-technique name.
- deduplicationstringBeta
Signal deduplication mode.
DEDUPLICATION_DEFAULTDEDUPLICATION_ENABLEDDEDUPLICATION_DISABLED
- deduplication_time_windowstringBeta
Time window for deduplication, such as
1h,24h,7d, orautomatic.
- scheduleobjectBeta
When the rule executes.
Show child attributesHide child attributes
- at_least_everystringBeta
Defines the minimum cadence as a duration string. It may contain components for days, hours, minutes, and seconds (e.g.
5d,5d3h,3d2h5m12s,12m16s).
- cron_expressionstringBeta
Defines the schedule using a Quartz cron expression.
- continuousbooleanBeta
Runs the rule continuously. Detection rules do not accept it: batch rules reject it, and streaming rules run continuously without it.
- enabledbooleanBeta
Sets whether the job is scheduled to run. Defaults to true.
- batchobjectBeta
Batch SQL rule input.
Show child attributesHide child attributes
- sqlobjectBeta
SQL query evaluated as the rule input.
Show child attributesHide child attributes
- default_catalog_namestringBeta
Default catalog used to resolve unqualified identifiers in
query. If unset, the rule'scatalog_nameis used.
- default_schema_namestringBeta
Default schema used to resolve unqualified identifiers in
query. If unset, the rule'sschema_nameis used.
- querystringBeta
SQL query evaluated as the rule input.
- customobjectBeta
Custom-notebook user function. The output is used as input data for the rule.
Show child attributesHide child attributes
- notebookstringBeta
Fully-qualified notebook path, or a path relative to the configured base notebook directory.
- optionsobjectBeta
Optional arguments supplied when invoking the custom function.
- warehouse_idstringBeta
SQL warehouse used to run this batch rule.
- outputobjectBeta
What to record in each signal.
Show child attributesHide child attributes
- summarystringBeta
Signal summary. May contain SQL expressions in braces that the server substitutes from the input row.
- contextobjectBeta
Key/value context to record from the input row. Values may contain SQL expressions in braces.
- default_contextbooleanBeta
If true, also record every column of the triggering input row. Custom context wins on key collision.
- event_time_columnstringBeta
Column in the rule output that holds the event timestamp.
- statusobjectBetaOutput only
Read-only lifecycle status.
Show child attributesHide child attributes
- job_idstringBetaOutput only
Databricks Jobs API job ID. Unset for a pure ingestion pipeline.
- lifecycle_statestringBetaOutput only
Scheduling lifecycle of the resource's underlying job/pipeline: whether it is unscheduled, scheduled, stopped, or deleted. Distinct from
run_state, which reports the outcome of the most recent run.UNSCHEDULEDSCHEDULEDSTOPPEDDELETED
- run_statestringBetaOutput only
Outcome / progress of the most recent (or in-flight) run.
RUNNINGSUCCEEDEDFAILEDCANCELED
- last_error_messagestringBetaOutput only
Most recent error message, if any. Pairs with
run_state = FAILED.
- create_timestringBetaOutput only
- last_start_timestringBetaOutput only
When the most recent run started. Pairs with
run_state = RUNNING.
- last_complete_timestringBetaOutput only
When the most recent run completed. Pairs with
run_state = SUCCEEDED.
- last_status_change_timestringBetaOutput only
- pipeline_idstringBetaOutput only
DLT ingestion-pipeline ID. Set only when this status represents the datasource's ingestion pipeline (unset for job statuses).
- suppress_until_timestringBeta
If set, this rule's signals do not open new alerts until the given time.
- original_content_packobjectBetaOutput only
Reference to the content pack this rule was originally installed from.
Show child attributesHide child attributes
- uuidstringBetaOutput only
UUID of the content pack.
- versionstringBetaOutput only
Pack version the resource was installed from.
- compute_workspace_idstringBetaOutput only
ID of the workspace whose compute runs this rule's jobs and owns its associated resources, such as the SQL warehouse a scheduled rule runs on. Server-assigned; a rule's warehouse can only be changed from this workspace.
- content_resource_idstringBetaImmutable
Immutable UUIDv4 identifying the authored content resource installed as this rule.
- referencesarray of stringBeta
Ordered reference URLs carried from the authored rule metadata. A maximum of three references of up to 512 characters each is supported. Requests exceeding these limits are rejected.
- runbookstringBeta
Long-form operational guidance carried from the authored rule metadata. Supports up to 4096 characters. Requests exceeding this limit are rejected.
- timerangeobjectBeta
Time-range configuration for batch rules. If unset, the execution time range is extended by a fixed
15mlookback.Show child attributesHide child attributes
- extend_lookbackstringBeta
Extends the start of the execution time range by a compact duration with integer days, hours, minutes, and seconds in that order, such as
1h30mor15m. Zero duration disables extension. Unset or empty uses a fixed15mat execution time. Only the start moves; the end is unchanged. Has no effect on batch SQL that does not useIN_TIMERANGE. Values must fit signed 64-bit microseconds.
Get a rule Beta
GET
Returns a single rule by its resource name.
API scopes: lakewatch
Parameters
- namestringRequiredpath
Full resource name of the detection rule, in the form
rules/{rule_id}.
Response
Returns the Rule object.
List rules Beta
GET
Lists rules, with optional filtering and pagination.
API scopes: lakewatch
Parameters
- page_sizeint32query
Maximum number of rules to return. The server may return fewer. If unset or 0, the server picks a default page size.
- page_tokenstringquery
Page token from a previous
ListRulesresponse, used to fetch the next page of results.
- filterstringquery
Filter expression that restricts the results, such as
rule_name = "my_rule"to return only the rule with that name. The name is matched against the current UC name, which reads report ineffective_rule_name.
- catalog_namestringRequiredquery
Name of the Unity Catalog catalog to list rules from. Required.
- schema_namestringquery
Name of a Unity Catalog schema in
catalog_name. If set, only rules in this schema are returned. If unset, rules in all schemas of the catalog are returned.
- viewstringquery
How much of each rule to return. Defaults to
RULE_VIEW_FULL.RULE_VIEW_BASICreturns only each rule's identity and Unity Catalog location.RULE_VIEW_BASICRULE_VIEW_FULL
Response
Returns a list of Rule objects.
Create a rule Beta
POST
Creates a new rule.
API scopes: lakewatch
Request body
The rule to create. Server-assigned fields (name, rule_id, timestamps,
etag, …) are ignored on the request.
- namestringIDImmutable
Resource name, in the form
rules/{rule_id}. Assigned by the server on create; required on update.
- catalog_namestringRequiredImmutable
Name of the Unity Catalog catalog that contains the rule. Required. Cannot be changed after creation. Reads return the value as supplied; the catalog's current name is reported in
effective_catalog_name.
- schema_namestringRequiredImmutable
Name of the Unity Catalog schema that contains the rule. Required. Cannot be changed after creation. Reads return the value as supplied; the schema's current name is reported in
effective_schema_name.
- rule_namestringRequiredImmutable
Name of the rule within its Unity Catalog schema. Required. Cannot be changed after creation. Reads return the value as supplied; the current UC name is reported in
effective_rule_name.
- descriptionstring
Free-form description.
- annotationsobject
Free-form client-managed key/value annotations.
- run_as_principalstring
The principal whose identity this rule's job runs as, given as a user email or service-principal application ID. When supplied on create/update, Lakewatch resolves the principal, records it on the rule, and creates the delegation to run as that principal — the requester must be authorized to delegate to it, or the request is rejected. When omitted on create, the requester's own identity is used. An update whose mask does not include
run_as_principalkeeps the current identity, and the requester must still be authorized to delegate to it; an editor who is not must supply a run_as_principal they can delegate to (for example, their own identity), or clear it, either of which reassigns the rule. An update whose mask includesrun_as_principalbut supplies no value clears it: the rule then runs as the requester, exactly as when it is omitted on create. Reads return the value as supplied; the identity the rule runs as is reported ineffective_run_as_principal.
- categorystring
Free-form rule category.
- severitystringRequired
Free-form severity label, such as
Informational,Medium,High, orCritical.
- fidelitystringRequired
Signal quality for this rule.
FIDELITY_DEVELOPMENTFIDELITY_INVESTIGATIVEFIDELITY_MEDIUMFIDELITY_HIGH
- objectivestring
Long-form description of what this rule detects.
- mitrearray of object
Up to 64 MITRE ATT&CK mappings, producing at most 192 flattened alert tags.
Show child attributesHide child attributes
- taxonomystring
Structured framework that organizes adversary behaviors, such as
mitre-attack.
- tacticstring
Adversary objective during this attack, such as
Command and Control.
- technique_idstring
MITRE technique ID, such as
T1078.
- techniquestring
Human-readable MITRE technique name.
- sub_technique_idstring
MITRE sub-technique ID, such as
T1078.001.
- sub_techniquestring
Human-readable MITRE sub-technique name.
- deduplicationstring
Signal deduplication mode.
DEDUPLICATION_DEFAULTDEDUPLICATION_ENABLEDDEDUPLICATION_DISABLED
- deduplication_time_windowstring
Time window for deduplication, such as
1h,24h,7d, orautomatic.
- scheduleobjectRequired
When the rule executes.
Show child attributesHide child attributes
- at_least_everystring
Defines the minimum cadence as a duration string. It may contain components for days, hours, minutes, and seconds (e.g.
5d,5d3h,3d2h5m12s,12m16s).
- cron_expressionstring
Defines the schedule using a Quartz cron expression.
- continuousboolean
Runs the rule continuously. Detection rules do not accept it: batch rules reject it, and streaming rules run continuously without it.
- enabledboolean
Sets whether the job is scheduled to run. Defaults to true.
- batchobject
Batch SQL rule input.
Show child attributesHide child attributes
- sqlobject
SQL query evaluated as the rule input.
Show child attributesHide child attributes
- default_catalog_namestring
Default catalog used to resolve unqualified identifiers in
query. If unset, the rule'scatalog_nameis used.
- default_schema_namestring
Default schema used to resolve unqualified identifiers in
query. If unset, the rule'sschema_nameis used.
- querystringRequired
SQL query evaluated as the rule input.
- customobject
Custom-notebook user function. The output is used as input data for the rule.
Show child attributesHide child attributes
- notebookstringRequired
Fully-qualified notebook path, or a path relative to the configured base notebook directory.
- optionsobject
Optional arguments supplied when invoking the custom function.
- warehouse_idstring
SQL warehouse used to run this batch rule.
- outputobjectRequired
What to record in each signal.
Show child attributesHide child attributes
- summarystring
Signal summary. May contain SQL expressions in braces that the server substitutes from the input row.
- contextobject
Key/value context to record from the input row. Values may contain SQL expressions in braces.
- default_contextboolean
If true, also record every column of the triggering input row. Custom context wins on key collision.
- event_time_columnstring
Column in the rule output that holds the event timestamp.
- suppress_until_timestring
If set, this rule's signals do not open new alerts until the given time.
- content_resource_idstringImmutable
Immutable UUIDv4 identifying the authored content resource installed as this rule.
- referencesarray of string
Ordered reference URLs carried from the authored rule metadata. A maximum of three references of up to 512 characters each is supported. Requests exceeding these limits are rejected.
- runbookstring
Long-form operational guidance carried from the authored rule metadata. Supports up to 4096 characters. Requests exceeding this limit are rejected.
- timerangeobject
Time-range configuration for batch rules. If unset, the execution time range is extended by a fixed
15mlookback.Show child attributesHide child attributes
- extend_lookbackstring
Extends the start of the execution time range by a compact duration with integer days, hours, minutes, and seconds in that order, such as
1h30mor15m. Zero duration disables extension. Unset or empty uses a fixed15mat execution time. Only the start moves; the end is unchanged. Has no effect on batch SQL that does not useIN_TIMERANGE. Values must fit signed 64-bit microseconds.
Response
Returns the Rule object.
Update a rule Beta
PATCH
Updates an existing rule.
API scopes: lakewatch
Parameters
- namestringRequiredIDImmutablepath
Resource name, in the form
rules/{rule_id}. Assigned by the server on create; required on update.
- update_maskstringRequiredquery
The set of fields to update. Only fields named in the mask are modified.
- etagstringquery
Optimistic-concurrency token from the latest read. A non-empty token that does not match the current
etagrejects the update as a conflict (HTTP 409). Omit this field or provide an empty string to update unconditionally.
Request body
The rule with its new field values. rule.name identifies the rule to
update.
- catalog_namestringRequiredImmutable
Name of the Unity Catalog catalog that contains the rule. Required. Cannot be changed after creation. Reads return the value as supplied; the catalog's current name is reported in
effective_catalog_name.
- schema_namestringRequiredImmutable
Name of the Unity Catalog schema that contains the rule. Required. Cannot be changed after creation. Reads return the value as supplied; the schema's current name is reported in
effective_schema_name.
- rule_namestringRequiredImmutable
Name of the rule within its Unity Catalog schema. Required. Cannot be changed after creation. Reads return the value as supplied; the current UC name is reported in
effective_rule_name.
- descriptionstring
Free-form description.
- annotationsobject
Free-form client-managed key/value annotations.
- run_as_principalstring
The principal whose identity this rule's job runs as, given as a user email or service-principal application ID. When supplied on create/update, Lakewatch resolves the principal, records it on the rule, and creates the delegation to run as that principal — the requester must be authorized to delegate to it, or the request is rejected. When omitted on create, the requester's own identity is used. An update whose mask does not include
run_as_principalkeeps the current identity, and the requester must still be authorized to delegate to it; an editor who is not must supply a run_as_principal they can delegate to (for example, their own identity), or clear it, either of which reassigns the rule. An update whose mask includesrun_as_principalbut supplies no value clears it: the rule then runs as the requester, exactly as when it is omitted on create. Reads return the value as supplied; the identity the rule runs as is reported ineffective_run_as_principal.
- categorystring
Free-form rule category.
- severitystringRequired
Free-form severity label, such as
Informational,Medium,High, orCritical.
- fidelitystringRequired
Signal quality for this rule.
FIDELITY_DEVELOPMENTFIDELITY_INVESTIGATIVEFIDELITY_MEDIUMFIDELITY_HIGH
- objectivestring
Long-form description of what this rule detects.
- mitrearray of object
Up to 64 MITRE ATT&CK mappings, producing at most 192 flattened alert tags.
Show child attributesHide child attributes
- taxonomystring
Structured framework that organizes adversary behaviors, such as
mitre-attack.
- tacticstring
Adversary objective during this attack, such as
Command and Control.
- technique_idstring
MITRE technique ID, such as
T1078.
- techniquestring
Human-readable MITRE technique name.
- sub_technique_idstring
MITRE sub-technique ID, such as
T1078.001.
- sub_techniquestring
Human-readable MITRE sub-technique name.
- deduplicationstring
Signal deduplication mode.
DEDUPLICATION_DEFAULTDEDUPLICATION_ENABLEDDEDUPLICATION_DISABLED
- deduplication_time_windowstring
Time window for deduplication, such as
1h,24h,7d, orautomatic.
- scheduleobjectRequired
When the rule executes.
Show child attributesHide child attributes
- at_least_everystring
Defines the minimum cadence as a duration string. It may contain components for days, hours, minutes, and seconds (e.g.
5d,5d3h,3d2h5m12s,12m16s).
- cron_expressionstring
Defines the schedule using a Quartz cron expression.
- continuousboolean
Runs the rule continuously. Detection rules do not accept it: batch rules reject it, and streaming rules run continuously without it.
- enabledboolean
Sets whether the job is scheduled to run. Defaults to true.
- batchobject
Batch SQL rule input.
Show child attributesHide child attributes
- sqlobject
SQL query evaluated as the rule input.
Show child attributesHide child attributes
- default_catalog_namestring
Default catalog used to resolve unqualified identifiers in
query. If unset, the rule'scatalog_nameis used.
- default_schema_namestring
Default schema used to resolve unqualified identifiers in
query. If unset, the rule'sschema_nameis used.
- querystringRequired
SQL query evaluated as the rule input.
- customobject
Custom-notebook user function. The output is used as input data for the rule.
Show child attributesHide child attributes
- notebookstringRequired
Fully-qualified notebook path, or a path relative to the configured base notebook directory.
- optionsobject
Optional arguments supplied when invoking the custom function.
- warehouse_idstring
SQL warehouse used to run this batch rule.
- outputobjectRequired
What to record in each signal.
Show child attributesHide child attributes
- summarystring
Signal summary. May contain SQL expressions in braces that the server substitutes from the input row.
- contextobject
Key/value context to record from the input row. Values may contain SQL expressions in braces.
- default_contextboolean
If true, also record every column of the triggering input row. Custom context wins on key collision.
- event_time_columnstring
Column in the rule output that holds the event timestamp.
- suppress_until_timestring
If set, this rule's signals do not open new alerts until the given time.
- content_resource_idstringImmutable
Immutable UUIDv4 identifying the authored content resource installed as this rule.
- referencesarray of string
Ordered reference URLs carried from the authored rule metadata. A maximum of three references of up to 512 characters each is supported. Requests exceeding these limits are rejected.
- runbookstring
Long-form operational guidance carried from the authored rule metadata. Supports up to 4096 characters. Requests exceeding this limit are rejected.
- timerangeobject
Time-range configuration for batch rules. If unset, the execution time range is extended by a fixed
15mlookback.Show child attributesHide child attributes
- extend_lookbackstring
Extends the start of the execution time range by a compact duration with integer days, hours, minutes, and seconds in that order, such as
1h30mor15m. Zero duration disables extension. Unset or empty uses a fixed15mat execution time. Only the start moves; the end is unchanged. Has no effect on batch SQL that does not useIN_TIMERANGE. Values must fit signed 64-bit microseconds.
Response
Returns the Rule object.