Detections

Important

Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.

A detection rule (or detection) defines how the system searches event data and generates a signal (a record containing key details for investigation) when the rule's conditions are met. Every detection rule runs your detection SQL over a time window on a schedule and generates a signal for each match. A rule can join tables, scan a whole table, or compute aggregates, which suits point-in-time analysis, baselining, and handling late-arriving logs.

You create detection rules in the UI at Detection rules using SQL or SQL pipe syntax, written inline. To get started, import prebuilt detection rules from the Content library.

In this section

Topic	Description
Write detection rules	How detection rules run, how to choose an approach for common patterns, and how to scope a rule to its time range
Create and manage detection rules	Create, view, update, and delete detection rules in the UI
Signals	Event records produced when events match a detection rule, with deduplication and a system table