Configure settings

In beta, manage your Lakewatch environment and configure its defaults from Settings. In the left navigation, select Settings, then select the environment to configure at the top of the page. Settings apply to the selected environment and are organized into tabs: Environment, Detection rules, Datasources, Alerts, and System errors.

Select Save changes on a tab to apply your edits.

Environment

The Environment tab manages your Lakewatch environment (the Unity Catalog catalog registered with Lakewatch) and the folders that hold its datasources and detection rules and scope access to them. To register another catalog as an environment, select Create environment.

• Details: The environment's backing catalog and the workspace it's bound to. An environment is an isolated Lakewatch instance, accessible only from this workspace, that stores its data in a catalog in Unity Catalog.
• Folders: The folders in this environment, each backed by a Unity Catalog schema. For each folder, the table shows the resource types it's the Default for (Datasources, Detection rules, or both) and its permissions (All account users, or the number of principals granted). When a resource type has a single default folder, Lakewatch creates new resources of that type there automatically. When more than one folder exists, you choose a folder when you create the resource. Select Create folder to add a folder, or Edit to change a folder's defaults and permissions. Folder permissions are Unity Catalog grants on the backing schema and apply to every resource in the folder. See Access control model.
• Lakewatch administrators: The principals who can manage this environment and its folders, datasources, and detection rules. To grant the Lakewatch admin privilege, enter one or more principals and select Grant. Select Revoke to remove it.

Detection rules

Detection rule categories for this catalog.

• Detection categories: The categories available when someone creates or edits a detection rule. Every rule must select one, so if you leave this empty, users can't create rules. The default categories are Static Signature, Fuzzy Signature, Behavioral, Statistical, and Learning (AI/ML). Select a category to remove it, or use Add to add a custom category.

Datasources

Defaults that new datasource ingestion pipelines inherit.

• Ingestion compute: The compute default for new datasource pipelines. Performance optimized uses performance-optimized compute for faster ingestion. Turn it off to use standard compute.

Alerts

How security alerts are grouped and delivered.

• Collation window: How long an open alert keeps grouping matching signals. Matching signals within this window join that alert, and other signals open a new alert. Set the amount and unit. The default is 1 hour.
• Alert destination: Where alerts are delivered. Select a destination and provide its configuration (for example, a webhook URL). For destination types and setup, see Alert destinations.
• Alert updates: For webhook and Tines destinations, select Also send alert updates to deliver later changes to an alert as separate update events. Use alert_id in each payload to match an update to its alert.

System errors

How system errors are grouped and delivered.

• Collation window: This setting has no effect. System errors use a fixed 24-hour grouping window. See how system errors are created.
• System error destination: Where system errors are delivered. Select a destination, or set it to Off to disable delivery.