Lakewatch documentation

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Lakewatch brings security information and event management (SIEM) capabilities directly to your Databricks lakehouse, helping security teams ingest, normalize, and analyze security data at scale.

• • Introduction to Lakewatch
  • An overview of Lakewatch's security data management capabilities and use cases.
• • Ingest and parse
  • Connect external sources of data and transform data for threat detection.
• • Detections
  • Create and manage SQL detection rules that scan event data and generate signals for investigation.
• • Alerts
  • Investigate and respond to alerts that group related signals, and export them to external systems.
• • Queries
  • Search, filter, and analyze your security data with SQL.
• • Genie
  • Use Genie Code for context-aware AI assistance or configure Genie Agents for deep threat investigations.
• • System health
  • Investigate system errors that group the system events Lakewatch generates for health and configuration problems.
• • Content library
  • Discover and import prebuilt content packs and detection rules into your workspace.
• • Admin
  • Review prerequisites, configure workspace settings, and manage access control.