Lakewatch documentation

Beta

Lakewatch is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage workspace-level previews.

Lakewatch helps security teams bring in security logs, detect threats, and investigate and respond to alerts, all on Databricks. Start with the walkthrough to see the full workflow, or go straight to the task you need.

Before you start

Lakewatch is set up one time for each workspace. The first time anyone opens Lakewatch, a guided setup flow creates its environment, which requires CREATE CATALOG on the metastore, or MANAGE and CREATE SCHEMA on an existing catalog. See Set up Lakewatch for your workspace.

Get started

Learn what Lakewatch does, then bring in your first security data source.

• • Learn how Lakewatch works
  • Explore the core concepts behind Lakewatch and how ingestion, detection, and investigation work together.
• • Follow an end-to-end walkthrough
  • Ingest data, run a detection rule, investigate an alert, and query your data in one guided run.
• • Bring in security data
  • Connect cloud storage, existing tables, or API connectors, and parse the logs into governed tables.

Detect and investigate threats

Write or install detection rules, respond to the alerts they create, and search your data for activity.

• • Detect threats with SQL rules
  • Write detection rules that run SQL on a schedule and generate signals when conditions match.
• • Install prebuilt detections
  • Browse detection rules that Databricks authors and install them into your workspace.
• • Triage and respond to alerts
  • Work through alerts that group related signals, and export them to Jira, ServiceNow, Tines, or a webhook.
• • Search across your security data
  • Search and filter events with SQL, view them on a timeline, and inspect individual rows.
• • Investigate threats with AI using Genie
  • Use Genie Code for in-product help and Genie Agents for multi-step threat investigations.

Monitor and administer

Keep your detection rules and datasources running, and control how your team sets up and accesses Lakewatch.

• • Monitor pipeline and rule health
  • Find and fix errors from failed detection rules and datasource runs.
• • Set up Lakewatch and control access
  • Meet the prerequisites, configure your workspace, and manage who can access Lakewatch resources.