Content library

The Content library is where you discover and install prebuilt detection rules, authored by Databricks, into your Lakewatch environment.

To open the Content library, navigate to Content library in the Lakewatch sidebar.

Browse detection rules

The Content library shows all available prebuilt rules in a searchable, filterable list. Each rule in the list shows:

• Rule: The rule's name. Click to open details.
• Imported: A check mark and the label Imported if the rule is already installed in your environment.
• Severity: The rule's severity level (Informational, Low, Medium, High, or Critical).
• MITRE tactic: The MITRE ATT&CK tactic the rule is associated with.
• MITRE technique: The MITRE ATT&CK technique and technique ID the rule maps to.
• Matching datasources: The datasources in your environment that use the parsers the rule queries. This column shows which rules apply to data you already ingest.

To narrow the list, search by rule name, parser, or technique ID, or filter by Severity, MITRE ATT&CK tactic and technique, Parser, Datasource, or Imported status. You can sort by rule name, imported status, severity, or matching datasources.

To see full details, click a rule. The rule's details page shows its severity, fidelity, category, and version, along with:

• Overview: The rule's objective and description.
• Runbook: The triage steps for the rule's alerts, if the rule includes one.
• MITRE ATT&CK: The tactics, techniques, and sub-techniques the rule maps to.
• References: External references for the rule.
• Detection logic: The rule's read-only detection SQL.
• Data requirements: The parsers and tables the rule requires, and the datasources in your environment that match them.
• Release notes: Changes to the rule over time.

To install the rule from the details page, click Import rule.

Install a detection rule

You install rules from the Content library into your current environment, and you can install several at the same time. A rule is installed against one of your datasources, so you can only install a rule if at least one datasource in your environment uses a parser the rule supports.

If no datasource matches, the rule's checkbox and Import rule button are disabled. To see which parsers the rule needs, hover over the checkbox or open the rule and check Data requirements. Then add a datasource that uses one of them.

1. In the Lakewatch sidebar, go to Content library.
2. Select the rules to install using the row checkboxes. Selections persist across pages. To review a rule first, click it to open its details panel.
3. Click Import rule (or Import N rules). The import dialog opens.
4. If you can create rules in more than one folder, choose a Destination folder for the rules. If only one folder is available, Lakewatch uses it automatically.
5. For each rule, review the Rule name and Target datasource:
   • Rule name: Lakewatch suggests a name based on the rule. If a rule with that name already exists, Lakewatch adds a numeric suffix (for example, _1). Edit the name if needed.
   • Target datasource: Select the datasources the rule runs against. Options group datasources that use the same parser and write to the same table. When matching datasources write to different folders or tables, the options show folder and table tags so you can tell them apart. If a rule queries more than one table, select a datasource for each table. Rules that don't query a table show No table selection required.
6. Click Import. Lakewatch installs the rules into your environment, showing progress for each rule. When a rule is created, a View rule link appears in its row. If a rule fails, its error appears in its row. Fix the problem and click Import again to retry.
7. Imported rules are disabled. When the import finishes, click View & enable rules to open Detection rules filtered to the new rules, or click Done to close the dialog.
8. In Detection rules, enable each rule and configure its schedule.

SQL rules run on the SQL warehouse selected for Lakewatch. The import dialog doesn't have a separate warehouse picker.

An installed rule is a copy in your environment. It behaves like any rule you create yourself, and you manage it from Detection rules. After the rules list refreshes, the Content library marks the rule as Imported.

Additional resources

• Create and manage detection rules
• Parser reference