Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.
Lakewatch ingests security logs from the following sources. Each source is ingested through an API connector or from cloud storage with Auto Loader, and is schematized by a built-in parser. Select a source for its onboarding steps, the parsed schema, and the observables Lakewatch extracts.
| Source | Data | Ingestion |
|---|---|---|
| 1Password | Audit events, item usages, sign-in attempts | API connectors |
| Akamai WAF | Web application firewall (WAF) security logs | API connectors |
| Atlassian | Organization audit logs | API connectors |
| AWS CloudTrail | Account activity and API usage | Cloud storage |
| AWS GuardDuty | Threat detection findings | Cloud storage |
| Azure audit logs | Microsoft Entra ID (Azure AD) audit logs | Cloud storage |
| Azure Monitor activity logs | Subscription-level resource activity | Cloud storage |
| Cloudflare audit logs | Account and zone configuration changes | Cloud storage |
| CrowdStrike | Falcon Event Streams logs | API connectors |
| GitHub | Organization audit logs | API connectors |
| Google Cloud audit logs | Admin activity, data access, and system events | Cloud storage |
| Google Workspace | Application and service audit activity | API connectors |
| Microsoft 365 | Audit logs (Azure AD, Exchange, SharePoint, Data Loss Prevention) | API connectors |
| Okta | System logs | API connectors |
| Wiz | Audit logs, issues, vulnerability findings | API connectors |
| Workday | Activity logging | API connectors |