Alerts

Important

Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.

An alert groups signals so you can investigate related activity together.

Tip

You can triage an alert with Genie Code from its detail page. See Triage alerts with Genie.

How are alerts created?

Lakewatch creates alerts automatically, and you can't create an alert manually. When a detection rule fires, Lakewatch groups related signals into a single alert through signal grouping rather than opening a new alert for every signal. A new signal attaches to an existing alert when all of the following conditions are met:

  • The signal shares the same rule ID, rule version, and summary as the signal that opened the existing alert.
  • The existing alert was opened within the collation window, which determines how long an alert stays open to collect matching signals. The collation window defaults to 1 hour and is configurable per catalog in Settings.
  • The existing alert is still in the Open or In progress state.

Lakewatch creates a new alert when no matching alert exists, the most recent matching alert was opened before the collation window, or the matching alert is resolved or marked as a duplicate.

The grouping criteria (rule ID, rule version, and summary) can't be customized, but you can change the collation window per catalog. Signal grouping is separate from signal deduplication, which runs earlier: deduplication drops identical signals as they're created, and grouping then organizes the surviving signals into alerts.

Note

An alert is grouped on the summary of the signal that opened it. When a rule fires, Lakewatch matches each new signal against the opening signal's summary, so the two summaries must be identical for the signals to land in the same alert.

A rule's summary is a template that can interpolate event data with {sql-expression} placeholders, and grouping compares the rendered text. If the summary includes a value that differs on every match, such as a timestamp or event ID, each signal renders a unique summary and opens its own alert instead of grouping. If a rule opens far more alerts than expected, check whether its summary can be generalized.

# Too specific: {time} differs on every event, so every failed login opens its own alert
summary: "Failed login by {actor.user.name} at {time}"

# Better: all of a user's failed logins render the same summary and group into one alert
summary: "Failed login by {actor.user.name}"

Alert limit for noisy rules

Each version of a detection rule can open at most 1,000 new alerts within a rolling 24-hour window. There is no limit on the number of signals a rule can produce.

When a rule version reaches the limit, Lakewatch stops opening new alerts for it and instead groups all further signals from that rule version into a single overflow alert with the summary "Too many signals detected for rule [rule ID]", so a noisy rule can't flood the alert list. The overflow alert is a regular alert: it appears in the alert list with severity inherited from the rule, and you can assign, comment on, and resolve it like any other alert. An overflow alert has a fixed collation window of 24 hours: while a rule version is over its limit, new signals attach to an existing open overflow alert from the past 24 hours if one exists, and otherwise open a new overflow alert.

Normal alert creation resumes automatically when the rule version's 24-hour alert count drops back below the limit. Because the limit is tracked per rule version, updating the rule (for example, tuning its query so it produces fewer distinct signals) also starts a fresh count.

Working with alerts

To manage alerts, navigate to Alerts. On the alerts list, you can:

  • Search and filter: Search alerts by alert ID or description. Filter by state (Active, In progress, Resolved, Duplicate, Unspecified), severity, assignee, detection rule, and date created. Search and filter selections persist across navigation within Lakewatch, and the active filter state is reflected in the URL. Copy the URL to share or bookmark a filtered view.
  • View the list: See all alerts in the current catalog that you can access. The list displays columns for severity, state, signal count, assignee, and timestamps. Columns are sortable and resizable.
  • Bulk actions: Select one or more alerts from the list to perform bulk updates, limited to 25 alerts per operation.
  • Open details: Click an alert ID to open the alert details page, where you can view signals and edit attributes.

Alert details

Click an alert ID to open the alert details page. The page is organized into two tabs:

  • Overview: Displays description, detection objective, and comments. You can edit the description by clicking "Edit Description". Comments support Markdown syntax.
  • Signals: Lists the signals that are grouped into this alert.

From the alert detail page, you can also:

  • Click a signal ID to view its details, including the rule used to generate it.
  • Use the Genie panel to investigate the alert: "Summarize this alert", "Triage this alert", or ask "What can I do with this alert?".

Alert attributes

Each alert has the following editable attributes:

  • Description: Custom text you can add or update to document the investigation. Edit it on the alert detail page with the "Edit Description" button.
  • Assignee: The user responsible for the investigation. Defaults to "Unassigned".
  • State: One of Open, In progress, Mitigated, Resolved, Duplicate, or Unspecified.
  • Severity: Inherited from the detection rule associated with the first signal connected to the alert. You can manually override severity at any time.
  • Classification: Indicates whether the activity captured in the alert is a real threat. Choose False positive, Benign positive, or True positive (or Unspecified if not yet triaged).

Each alert also has the following read-only attributes:

  • Alert ID (seq_id): A unique system-generated identifier, displayed as Alert <uuid> and SEC-<number>. Copy it with the "Copy ID" button.
  • Alert title: System-generated summary of the alert. Immutable; cannot be edited. Based on the detection rule's summary template.
  • Permalink: A stable link to the alert (the seq_id). Copy it with the "Copy permalink" button.
  • Rule: The detection rule that produced the alert's signals.
  • Rule owner: The principal that owns the detection rule.
  • First/Last event: Timestamps of when the first and last signals attached to the alert were created.
  • Signal count: The number of signals attached to the alert. This count is approximate and can lag, especially under high signal load.
  • Created at: Timestamp of when the alert was created.
  • Updated at: Timestamp of when the alert was last modified.

Exporting alerts

Export alerts to an external system, such as ServiceNow, Tines, a webhook, or Jira, so your team can track and act on them in the tools it already uses. For destinations and setup, see Alert destinations.

Additional resources

  • Last updated on