Skip to main content
Last updated on

Detections

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

A detection rule (or detection) defines how the system searches event data and generates a signal (a record containing key details for investigation) when the rule's conditions are met. Every detection rule runs your detection SQL over a time window on a schedule and generates a signal for each match. A rule can join tables, scan a whole table, or compute aggregates, which suits point-in-time analysis, baselining, and handling late-arriving logs.

You create detection rules in the UI at Detection rules using SQL or SQL pipe syntax, written inline. To get started, import prebuilt detection rules from the Content library.

In this section​

    • Write detection rules
    • How detection rules run, how to choose an approach for common patterns, and how to scope a rule to its time range
    • Signals
    • Event records produced when events match a detection rule, with deduplication and a system table
On this page