Supported logs

Important

Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.

Lakewatch ingests security logs from the following sources. Each source is ingested through an API connector or from cloud storage with Auto Loader, and is schematized by a built-in parser. Select a source for its onboarding steps, the parsed schema, and the observables Lakewatch extracts.

Source	Data	Ingestion
1Password	Audit events, item usages, sign-in attempts	API connectors
Akamai WAF	Web application firewall (WAF) security logs	API connectors
Atlassian	Organization audit logs	API connectors
AWS CloudTrail	Account activity and API usage	Cloud storage
AWS GuardDuty	Threat detection findings	Cloud storage
Azure Monitor logs (generic)	Azure Activity Log events and other Azure Monitor log categories	Cloud storage
Box	Enterprise audit events	API connectors
Cloudflare audit logs	Account and zone configuration changes	Cloud storage
CrowdStrike	Falcon Event Streams logs	API connectors
GitHub	Organization audit logs	API connectors
Google Cloud audit logs	Admin activity, data access, and system events	Cloud storage
Google Workspace	Application and service audit activity	API connectors
Microsoft 365	Audit logs (Azure AD, Exchange, SharePoint, Data Loss Prevention)	API connectors
Microsoft Entra ID audit logs	Directory and administrative changes	Cloud storage
Microsoft Entra ID Protection logs	Risky users and user risk detections	Cloud storage
Microsoft Entra ID provisioning logs	User and group provisioning to connected applications	Cloud storage
Microsoft Entra ID sign-in logs	User, service principal, and managed identity sign-ins	Cloud storage
Microsoft Graph activity logs	Microsoft Graph API requests	Cloud storage
Okta	System logs	API connectors
OpenAI	Organization audit logs	API connectors
Wiz	Audit logs, issues, vulnerability findings	API connectors
Workday	Activity logging	API connectors
Zendesk	Account audit logs	API connectors