Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.
This guide walks through the core Lakewatch workflow end-to-end, from ingesting data to running detection rules, investigating alerts, and monitoring system health.
Ingest and schematize data
Lakewatch ingests data using datasources, which combine an ingestion method (how raw data is read) with one or more parsers (which schematize the raw data into governed tables). You can create and manage datasources in the UI.
Ingest raw data using one of three methods:
- Cloud storage: Point to files in a supported object store (for example, an S3 bucket or a
/Volumes/path). - Existing table: Ingest a Unity Catalog table or view that already exists in your workspace, without copying the data.
- API connectors: Use a managed connector to pull data directly from SaaS applications like CrowdStrike, Okta, and others.
Schematize the raw data with parsers. Each parser describes the output columns of a log source and writes a parsed table with the Lakewatch-managed lw_id, lw_meta, and lw_observables columns. Incoming events are classified to the first matching parser; unmatched events are routed to a dead-letter sentinel. The parsed tables are ready for security analysis with detection rules and queries.
To learn more, see Create and manage datasources.
Create and run detection rules
Go to Detection rules to create detection rules. You can categorize rules using the MITRE ATT&CK framework or a custom framework, set a processing schedule, and define signal output.
Lakewatch detection rules are authored in SQL or SQL pipe syntax.
To learn more, see Detection rules.
Investigate alerts
Detection rules generate signals when events match their criteria. Lakewatch automatically correlates related signals into alerts. Go to Alerts to view, assign, and manage alerts. Open an alert to review its signals and the detection rules that triggered them.
You can also export alerts to ServiceNow, Tines, a webhook, or Jira, or triage an alert with Genie.
To learn more, see Alerts.
Query data
Go to Query to run SQL queries over your security data. The query page supports time-range filtering, no-code refinements, a timeline visualization, and detailed row inspection.
To learn more, see Query data.
Investigate with Genie
Genie can help you investigate security events using natural language.
Genie Code is the AI assistant available across the Lakewatch UI. Use it to write SQL queries, build detection rules, explore datasources, and more. Click Genie in the left-hand menu, or click the Genie icon in the upper-right corner to open it alongside any page. To learn more, see Genie Code example prompts.
Genie Agents provide a dedicated environment for deep investigative work with the Genie Research Agent. Connect your parsed tables and system tables to a Genie Agent, then use multi-step reasoning, SQL generation, and MITRE ATT&CK mapping to investigate threats. To learn more, see Configure a Genie Agent for threat intel.
Monitor system health
When Lakewatch detects system health or configuration problems, it generates system events and groups them into system errors. Go to System errors to view, assign, and manage system errors and their associated events.
To learn more, see System errors.
The Overview page
The Overview page is your Lakewatch homepage, summarizing ingestion, detection, and alert activity with a fast path into Genie.