Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.
The Content library is where you discover and install prebuilt detection rules, authored by Databricks, into your Lakewatch catalog.
To open the Content library, navigate to Content library in the Lakewatch sidebar. The Content library displays prebuilt detection rules you can install into your catalog. Use filters and the search box to narrow the list.
Browse detection rules
The Content library shows all available prebuilt rules, organized in a searchable, filterable list. The library typically contains dozens of rules across multiple pages. Each rule in the list shows:
- Rule: The rule's name. Click to open details.
- Severity: The rule's severity level (Informational, Low, Medium, High, or Critical).
- MITRE tactic: The MITRE ATT&CK tactic the rule is associated with.
- MITRE technique: The MITRE ATT&CK technique and technique ID the rule maps to.
- Matching datasources: The datasources in your catalog that use the parsers the rule queries. This column shows which rules apply to data you already ingest. A rule with no matching datasources shows
—.
To see full details, click a rule to open its details panel, which also shows the rule's source content pack, objective, and fidelity. You can start an install from the panel with Import, or select rules from the list as described below.
Install a detection rule
You install rules from the Content library into your current environment, and you can install several simultaneously.
Note
Detection rules are provided AS-IS, without any guarantees or warranties, and are not supported by Databricks. Review each rule to confirm it's suitable for your use case before you install it.
- In the Lakewatch sidebar, go to Content library.
- Select the rules to install using the row checkboxes. To review a rule first, click it to open its details panel.
- Click Import rule (or Import N rules). The import dialog opens.
- Under SQL tables, set the source table for each table the rules query. Lakewatch pre-selects a table from the first datasource whose parser matches the rule, so rules that match your datasources are ready to install. Change a table if you need a different one. You must set every table before you can continue.
- To rename a rule or override the tables it queries, expand it under Rules to import. To check the final query, click preview on a rule to see its SQL with your tables substituted.
- Click Import. Lakewatch installs the rules into your environment one at a time, showing a green checkmark and a View rule link for each rule as it's created. If a rule fails, its error appears in the dialog.
- Click Done to close the dialog, or select a View rule link to open a newly installed rule. The rule installs as disabled.
- Go to Detection rules to enable the rule and configure its schedule.
An installed rule is a copy in your environment. It behaves like any rule you create yourself, and you manage it from Detection rules. If a rule with the same name already exists, Lakewatch appends a suffix to the new rule's name.