Supported logs
Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.
Lakewatch ingests security logs from the following sources. Each source is ingested through an API connector or from cloud storage with Auto Loader, and is schematized by a built-in parser. Select a source for its onboarding steps, the parsed schema, and the observables Lakewatch extracts.
Source | Data | Ingestion |
|---|---|---|
Audit events, item usages, sign-in attempts | API connectors | |
Web application firewall (WAF) security logs | API connectors | |
Organization audit logs | API connectors | |
Account activity and API usage | Cloud storage | |
Threat detection findings | Cloud storage | |
Microsoft Entra ID (Azure AD) audit logs | Cloud storage | |
Subscription-level resource activity | Cloud storage | |
Account and zone configuration changes | Cloud storage | |
Falcon Event Streams logs | API connectors | |
Organization audit logs | API connectors | |
Admin activity, data access, and system events | Cloud storage | |
Application and service audit activity | API connectors | |
Audit logs (Azure AD, Exchange, SharePoint, Data Loss Prevention) | API connectors | |
System logs | API connectors | |
Audit logs, issues, vulnerability findings | API connectors | |
Activity logging | API connectors |