Roles and capabilities

Lakewatch governs each resource type with Unity Catalog privileges. This reference lists the privileges for datasources, detection rules, signals, alerts, and queries, and the capability each one grants.

How privileges are organized

Datasources and detection rules have resource privileges. Detection rules also have security-data privileges, because only rules produce signals and alerts:

• Resource privileges: Govern the resource itself: reading its configuration, managing it, and managing its access.
• Security-data privileges: Govern a detection rule's outputs: the signals and alerts it produces.

You grant these privileges on a folder (schema) or the environment (catalog), and they inherit down to every resource beneath.

Permission groups

In the Lakewatch UI, you grant access with permission groups instead of individual privileges. A folder permission group grants its privileges on the folder's schema, so they apply to every datasource and detection rule in the folder. Lakewatch admin is granted on the environment's catalog, so it applies to every folder. Combine permission groups for one principal, or select individual permissions to make a Custom grant.

You don't grant USE CATALOG and USE SCHEMA separately. Lakewatch grants all account users USE CATALOG on the environment's catalog and USE SCHEMA on every folder, regardless of the folder's other permissions. These traversal privileges allow users to reach a folder but not to view or change anything in it. The UI hides Detection rule manager and Alert triage on the default datasource folder, and Datasource manager on the default detection rule folder, because those permissions don't apply to the resources the folder holds.

When you select individual permissions for a Custom grant, the UI shows each privilege under the following label:

CREATE_SECRET only lets you create the Unity Catalog secrets that alert destinations and Settings export destinations use, stored in the __lakewatch schema. API connectors don't use it. They authenticate through Unity Catalog connections.

Recommended groups

Databricks recommends four groups that map to the roles on a security team. For the steps that create these groups and assign their permissions, see Set up access control.

What each group can do

Folder permissions apply to every resource in the folder, including resources that other users created. This access comes from the folder or catalog grant, not from an administrator override. The access control model has no override, so a group reaches exactly what its grants cover, and nothing in a folder where it holds no grant.

• lakewatch-admins manage the entire environment: they create, view, edit, delete, and reshare any datasource or detection rule (MANAGE), read the signals and alerts that every detection rule produces, update its alerts, and query all Lakewatch tables (SELECT), add folders, and change the environment's settings and administrators.
• lakewatch-data-engineers create and manage datasources in the datasource folder, and create, query, and write its tables (CREATE TABLE, SELECT, MODIFY).
• lakewatch-detection-engineers create and manage detection rules in the detection rule folder, read the security data those rules produce (READ_SECURITY_DATA), and view and query the datasources their rules read from (READ_METADATA, SELECT on the datasource folder).
• lakewatch-analysts work the alert queue: they read the alerts and signals produced by the rules in the detection rule folder and update the alerts (READ_SECURITY_DATA, UPDATE_SECURITY_DATA), view rule configuration (READ_METADATA), and query the datasource and detection tables (SELECT).

A group reaches another member's resources only as far as its granted privileges extend: viewing a resource requires READ_METADATA or MANAGE, and working with a rule's signals and alerts requires the matching security-data privilege. Ownership adds full control, so whoever creates a resource can manage it regardless of group membership, and changing a resource or its access requires MANAGE or ownership.

Share resources with your team

You share Lakewatch resources through folders. A permission group on a folder applies to every datasource and detection rule in the folder, including resources created later. To share resources with your team, do one of the following:

• Use a folder the team can access: Create the resource in a folder where the team already has the permission group it needs.
• Grant the team access to the folder: A user with MANAGE on the folder, such as a Folder admin or Lakewatch admin, grants the team a permission group on the folder. For example, grant Alert triage so the team can work the folder's alerts.

With the team-based setup in Set up access control, each team already has the permission group it needs on its folder, so resources you create there are shared with the team automatically. To limit who can access a resource, create it in a folder that only the intended team can access.

Datasources and detection rules

Datasources and detection rules share the same resource privileges and security-data privileges. They differ in the create privilege (CREATE_DATASOURCE for a datasource, CREATE_RULE for a detection rule). Detection rules produce signals and alerts, and datasources raise system errors, which Lakewatch records as alerts:

To create a datasource, you must have CREATE_DATASOURCE on its folder, which Datasource manager, Folder admin, and Lakewatch admin include. To create a detection rule, you must have CREATE_RULE on its folder, which Detection rule manager, Folder admin, and Lakewatch admin include. Creating a resource also requires USE CATALOG and USE SCHEMA, which Lakewatch grants to all account users.

Access to a resource another user owns follows these same privileges, whether it is a datasource or a detection rule:

• To view it, you must have READ_METADATA or MANAGE on its folder or environment.
• To edit or delete it, you must have MANAGE or be its owner.
• To change who can access it, you must have MANAGE_ACCESS_CONTROL (included in MANAGE) or be its owner.

In every case, the principal must also have USE CATALOG on the catalog and USE SCHEMA on the schema that contain the resource, because a datasource or detection rule is a Unity Catalog securable that a principal must be able to reach before any privilege on it takes effect. Lakewatch grants both to all account users. See Privileges.

Signals and alerts (derived artifacts)

Signals and alerts are derived artifacts. They aren't separate securables, so the security-data privileges on the parent detection rule or datasource control access to them:

Signals are immutable, so only alerts can be updated.

Queries

You manage query access through the Lakewatch app, using these permission levels: