Configure settings

Important

Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.

In beta, manage your Lakewatch environment and configure its defaults from Settings. In the left navigation, select Settings, then select the environment to configure at the top of the page. Settings apply to the selected environment and are organized into tabs: Environment, Detection rules, Datasources, Alerts, and System errors.

Note

You need the MANAGE privilege on the catalog to change these settings. Without it, the controls are read-only.

Select Save changes on a tab to apply your edits.

Environment

The Environment tab manages your Lakewatch environment (the Unity Catalog catalog registered with Lakewatch) and the folders that hold its datasources and detection rules and scope access to them. To register another catalog as an environment, select Create environment.

• Details: The environment's backing catalog and the workspace it's bound to. An environment is an isolated Lakewatch instance, accessible only from this workspace, that stores its data in a catalog in Unity Catalog.
• Folders: The folders in this environment, each backed by a Unity Catalog schema. For each folder, the table shows the resource types it's the Default for (Datasources, Detection rules, or both) and its permissions (All account users, or the number of principals granted). When a resource type has a single default folder, Lakewatch creates new resources of that type there automatically; when more than one folder exists, you choose a folder when you create the resource. Select Create folder to add a folder, or Edit to change a folder's defaults and permissions. Folder permissions are Unity Catalog grants on the backing schema and apply to every resource in the folder. See Access control model.
• Lakewatch administrators: The principals who can manage this environment and its folders, datasources, and detection rules. To grant the Lakewatch admin privilege, enter one or more principals and select Grant; select Revoke to remove it.

Detection rules

Detection rule categories for this catalog.

• Detection categories: The categories available when someone creates or edits a detection rule. Every rule must select one, so if you leave this empty, users can't create rules. The default categories are Static Signature, Fuzzy Signature, Behavioral, Statistical, and Learning (AI/ML). Select a category to remove it, or use Add to add a custom category.

Datasources

Defaults that new datasource ingestion pipelines inherit.

• Ingestion compute: The compute default for new datasource pipelines. Performance optimized uses performance-optimized compute for faster ingestion; turn it off to use standard compute.

Alerts

How security alerts are grouped and delivered.

• Collation window: How long an alert keeps collating matching security events. Events that match an open alert within this window are added to it; anything else opens its own alert. Set the amount and unit; the collation window defaults to 1 hour.
• Alert destination: Where alerts are delivered. Select a destination and provide its configuration (for example, a webhook URL). For destination types and setup, see Alert destinations.
• Also send alert updates: When enabled, later changes to an alert are delivered as separate update events. Use the ID in each payload to associate an update with the original event.

System errors

How system errors are grouped and delivered.

• Collation window: How long a system error keeps collating matching system events. Events that match an open system error within this window are added to it; anything else opens its own system error.
• System error destination: Where system errors are delivered. Select a destination, or set it to Off to disable delivery.