Supported logs
Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.
Lakewatch ingests security logs from the following sources. Each source is ingested through an API connector or from cloud storage with Auto Loader, and is schematized by a built-in parser. Select a source for its onboarding steps, the parsed schema, and the observables Lakewatch extracts.
Source | Data | Ingestion |
|---|---|---|
Audit events, item usages, sign-in attempts | API connectors | |
Web application firewall (WAF) security logs | API connectors | |
Organization audit logs | API connectors | |
Account activity and API usage | Cloud storage | |
Threat detection findings | Cloud storage | |
Azure Activity Log events and other Azure Monitor log categories | Cloud storage | |
Enterprise audit events | API connectors | |
Account and zone configuration changes | Cloud storage | |
Falcon Event Streams logs | API connectors | |
Organization audit logs | API connectors | |
Admin activity, data access, and system events | Cloud storage | |
Application and service audit activity | API connectors | |
Audit logs (Azure AD, Exchange, SharePoint, Data Loss Prevention) | API connectors | |
Security alerts (Defender XDR, Sentinel) | API connectors | |
Directory and administrative changes | Cloud storage | |
Risky users and user risk detections | Cloud storage | |
User and group provisioning to connected applications | Cloud storage | |
User, service principal, and managed identity sign-ins | Cloud storage | |
Microsoft Graph API requests | Cloud storage | |
System logs | API connectors | |
Organization audit logs | API connectors | |
Audit logs, issues, vulnerability findings | API connectors | |
Activity logging | API connectors | |
Account audit logs | API connectors |