Databricks SDK for JavaScript
    Preparing search index...

    Interface Rule

    A Lakewatch detection rule: a query that evaluates ingested data and generates a signal for each match. Each rule is a securable in a Unity Catalog schema.

    interface Rule {
        annotations?: Record<string, string>;
        catalogName?: string;
        category?: string;
        computeWorkspaceId?: string;
        contentResourceId?: string;
        createdBy?: Principal;
        createTime?: Instant;
        deduplication?: RuleDeduplication;
        deduplicationTimeWindow?: string;
        description?: string;
        effectiveCatalogName?: string;
        effectiveRuleName?: string;
        effectiveRunAsPrincipal?: string;
        effectiveSchemaName?: string;
        etag?: string;
        fidelity?: RuleFidelity;
        mitre?: RuleMitreMapping[];
        name?: string;
        objective?: string;
        originalContentPack?: ContentPackReference;
        output?: RuleOutput;
        owner?: Principal;
        references?: string[];
        ruleId?: string;
        ruleName?: string;
        runAsPrincipal?: string;
        runbook?: string;
        schedule?: RuleSchedule;
        schemaName?: string;
        severity?: string;
        source?: { $case: "batch"; batch: RuleInputBatch };
        status?: ResourceStatus;
        suppressUntilTime?: Instant;
        timerange?: RuleTimeRange;
        updatedBy?: Principal;
        updateTime?: Instant;
        version?: bigint;
    }
    Index

    Properties

    annotations? catalogName? category? computeWorkspaceId? contentResourceId? createdBy? createTime? deduplication? deduplicationTimeWindow? description? effectiveCatalogName? effectiveRuleName? effectiveRunAsPrincipal? effectiveSchemaName? etag? fidelity? mitre? name? objective? originalContentPack? output? owner? references? ruleId? ruleName? runAsPrincipal? runbook? schedule? schemaName? severity? source? status? suppressUntilTime? timerange? updatedBy? updateTime? version?

    Properties

    annotations?: Record<string, string>

    Free-form client-managed key/value annotations.

    catalogName?: string

    Name of the Unity Catalog catalog that contains the rule. Required. Cannot be changed after creation. Reads return the value as supplied; the catalog's current name is reported in effective_catalog_name.

    category?: string

    Free-form rule category.

    computeWorkspaceId?: string

    ID of the workspace whose compute runs this rule's jobs and owns its associated resources, such as the SQL warehouse a scheduled rule runs on. Server-assigned; a rule's warehouse can only be changed from this workspace.

    contentResourceId?: string

    Immutable UUIDv4 identifying the authored content resource installed as this rule.

    createdBy?: Principal

    Principal that created the rule.

    createTime?: Instant

    Time the rule was created.

    deduplication?: RuleDeduplication

    Signal deduplication mode.

    deduplicationTimeWindow?: string

    Time window for deduplication, such as 1h, 24h, 7d, or automatic.

    description?: string

    Free-form description.

    effectiveCatalogName?: string

    Current name of the Unity Catalog catalog that contains the rule. Reflects catalog renames, which do not change catalog_name. Unset until resolved.

    effectiveRuleName?: string

    Current UC leaf name of the rule (server-owned). Tracks UC renames so callers can observe the live name without having to update the client-owned rule_name; unset until resolved.

    effectiveRunAsPrincipal?: string

    The identity this rule's job runs as: the resolved run_as_principal, or the requester's identity when it was omitted on create or cleared on update. The value is a user email or service-principal application ID, falling back to the numeric principal ID if that identity can no longer be resolved. Populated on single-rule reads (get/create/update); list responses omit it.

    effectiveSchemaName?: string

    Current name of the Unity Catalog schema that contains the rule. Reflects schema renames, which do not change schema_name. Unset until resolved.

    etag?: string

    Opaque entity tag for optimistic concurrency. Content-version ETags change on user edits and remain stable across runtime status updates.

    fidelity?: RuleFidelity

    Signal quality for this rule.

    mitre?: RuleMitreMapping[]

    Up to 64 MITRE ATT&CK mappings, producing at most 192 flattened alert tags.

    name?: string

    Resource name, in the form rules/{rule_id}. Assigned by the server on create; required on update.

    objective?: string

    Long-form description of what this rule detects.

    originalContentPack?: ContentPackReference

    Reference to the content pack this rule was originally installed from.

    output?: RuleOutput

    What to record in each signal.

    owner?: Principal

    Unity Catalog owner of the rule. Assigned by the server. Populated by GetRule.

    references?: string[]

    Ordered reference URLs carried from the authored rule metadata. A maximum of three references of up to 512 characters each is supported. Requests exceeding these limits are rejected.

    ruleId?: string

    Unity Catalog securable UUID of the rule, and the last segment of name. Never changes, including when the rule's catalog or schema is renamed.

    ruleName?: string

    Name of the rule within its Unity Catalog schema. Required on create; can be updated within the same catalog and schema. Get synchronizes this field with the current Unity Catalog name, also reported in effective_rule_name.

    runAsPrincipal?: string

    The principal whose identity this rule's job runs as, given as a user email or service-principal application ID. When supplied on create/update, Lakewatch resolves the principal, records it on the rule, and creates the delegation to run as that principal — the requester must be authorized to delegate to it, or the request is rejected. When omitted on create, the requester's own identity is used. An update whose mask does not include run_as_principal keeps the current identity, and the requester must still be authorized to delegate to it; an editor who is not must supply a run_as_principal they can delegate to (for example, their own identity), or clear it, either of which reassigns the rule. An update whose mask includes run_as_principal but supplies no value clears it: the rule then runs as the requester, exactly as when it is omitted on create. Reads return the value as supplied; the identity the rule runs as is reported in effective_run_as_principal.

    runbook?: string

    Long-form operational guidance carried from the authored rule metadata. Supports up to 4096 characters. Requests exceeding this limit are rejected. Supports Markdown; analysts and the investigation agent follow it when triaging this rule's alerts.

    schedule?: RuleSchedule

    When the rule executes.

    schemaName?: string

    Name of the Unity Catalog schema that contains the rule. Required. Cannot be changed after creation. Reads return the value as supplied; the schema's current name is reported in effective_schema_name.

    severity?: string

    Free-form severity label, such as Informational, Medium, High, or Critical.

    source?: { $case: "batch"; batch: RuleInputBatch }

    The input data the rule operates on. Exactly one source is required.

    Type Declaration

    status?: ResourceStatus

    Read-only lifecycle status.

    suppressUntilTime?: Instant

    If set, this rule's signals do not open new alerts until the given time.

    timerange?: RuleTimeRange

    Time-range configuration for batch rules. If unset, the execution time range is extended by a fixed 15m lookback.

    updatedBy?: Principal

    Principal that last updated the rule.

    updateTime?: Instant

    Time the rule was last updated.

    version?: bigint

    Monotonic version, bumped on each update. Informational; use etag for optimistic concurrency.

    Settings

    Member Visibility

    On This Page

    Properties