Skip to main content
Last updated on

Ingest and parse

Beta

Lakewatch is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage workspace-level previews.

Lakewatch ingests security data from cloud storage, existing tables within Databricks, or API connectors. It then uses parsers to transform the data into a normalized schema ready for security analysis. This ingestion and parsing pipeline is called a datasource.

This section teaches you how to create and manage datasources, how to work with the built-in parsers provided for many common sources of security data, and how to create custom parsers.

In this section​

    • Supported logs
    • Browse the log sources Lakewatch supports, with onboarding steps, parsed schema, and observables for each
    • Custom logs
    • Edit existing parsers or create custom parsers
On this page