Signals
Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.
A signal is an event record produced when one or more events match the criteria of a detection rule, such as multiple failed login attempts from a specific user. Each signal is one row returned by the rule and includes a summary of the detected behavior, the event time, the rule that produced it, its severity, and event context. Signals can exist without an associated alert, for example when the rule is suppressed and no matching alert is open.
To view signals, go to Alerts and open an alert to see its related signals. To query signals directly, use the signals view.
Signal deduplication
Lakewatch automatically prevents duplicate signals from cluttering your workspace. Two signals are duplicates when a rule produces a result row whose values are identical across all detection output fields (not only the summary) to a signal that the same rule already created within the deduplication time window. Deduplication is scoped to a single rule, so different rules never deduplicate against each other.
When Lakewatch detects a duplicate, it skips that signal entirely: no new signal is inserted and no alert is opened or updated.
Deduplication is distinct from signal grouping, which happens later. A matching summary only leads to deduplication when the rest of the output row matches, too. A matching summary alone leads to grouping.
- Deduplication runs when signals are created and drops a signal only when it matches an existing signal across every detection-output field. Two signals that share a summary but differ in any other fields are both created.
- Signal grouping then organizes the surviving signals into alerts using the summary (plus rule ID and version), and nothing else. Signals that share the opening signal's summary attach to the same alert, even when their other fields differ.
Deduplication prevents duplicate signals when a scheduled rule's runs cover overlapping time ranges. This can happen in several situations, such as when a rule looks back further than its schedule interval to catch late-arriving data, or when a run is delayed or re-run.
Enable or disable deduplication
Deduplication is enabled by default for every scheduled rule. To turn it off for a rule, disable the rule's Deduplication setting. In the rule's YAML, set deduplication to one of these values:
DEDUPLICATION_ENABLED: Deduplicate this rule's signals.DEDUPLICATION_DEFAULT, or leaving the field unset, behaves the same way.DEDUPLICATION_DISABLED: Never deduplicate this rule's signals.
For where to set this value, see Create and manage detection rules.
Deduplication time window
The time window controls how far back Lakewatch looks for an identical signal. By default, the window is automatic: 3× the rule's schedule interval, capped at 7 days. For example, a rule that runs hourly uses a 3-hour window, and a rule that runs daily uses a 3-day window.
To set the window yourself, set Deduplication time window to Custom, then enter a number and select Minutes, Hours, or Days. The window can't exceed 7 days. In the rule's YAML, set deduplication_time_window to a duration such as 1h, 24h, or 7d. Databricks recommends leaving the window on Automatic.
Signals view
Query signals using the <UC-CATALOG>.__lakewatch.signals view, where <UC-CATALOG> is your Lakewatch environment's catalog. The view contains signals produced by rules in that catalog, including signals without an associated alert. It holds metadata about signals and the IDs of their associated alerts. Query it to analyze signals, correlate them with alerts, and build custom reports or dashboards.
To view and manage alerts, use the Alerts page in the UI.