Detection Engineering Skill
A Databricks Genie Code skill that turns Genie's Agent mode into a detection-engineering assistant. Ask natural-language questions about your security telemetry, and it runs bounded SQL, surfaces distributional evidence, asks for input when it hits ambiguity, and helps you package defensible detection rules.
The workflow
A structured five-step path from raw telemetry to a packaged detection rule.
- Orient — describe the table schema and sample rows
- Baseline — measure frequency, timing, and behavioral distributions
- Segment — split by entity, role, or time to isolate signal from noise
- Evaluate — backtest candidate logic against historical data
- Package — produce a detection spec with logic, evidence, and caveats
What it does
Runs bounded SQL
Ask in natural language. The skill runs bounded queries and surfaces distributional evidence instead of opaque answers.
Asks when it's unsure
It requests the expert context it can't infer from SQL — business hours, accounts to exclude — then iterates with you.
Packages defensible rules
When the evidence is strong, it produces a detection spec and creates the rule in the Lakewatch Detection Rules UI.
Reference analyses
The skill ships with reference files Genie loads on demand, each covering a common analysis. Extend or modify them for your own data.
Get started
Prerequisites
A Databricks workspace with Genie Code enabled, Agent mode access, and Unity Catalog SELECT on the telemetry tables you want to baseline.
Install the skill
Drop the detection-engineering folder into your workspace .assistant/skills/ path. Skills are auto-discovered on the next Agent session — no registration step.
Setup guide ↗Use it
@mention the skill in Agent mode and point it at a table to baseline. It loads reference files on demand as the analysis progresses.
Talk to us about Cyber AI Skills
Want this skill tuned to your telemetry, or more detection-engineering skills for your team? Let's talk.