What is an agentic SIEM and how does it work?

Summary

• Agents do the security analysis. An agentic SIEM uses autonomous AI agents to orchestrate threat detection, triage, investigation, and response across security data, so analysts direct the work rather than hand-querying data and chasing alert floods.
• Human at the helm. Analysts move from repetitive manual work to directing swarms of agents that hunt, summarize, and correlate signals across security, IT, and business data in seconds.
• Built on an open security lakehouse. On Databricks, Lakewatch unifies security, IT, and business telemetry at petabyte scale using open standards (OCSF, Delta, Parquet, SQL).
• Natural-language investigation. Genie, the agentic interface in Lakewatch, lets analysts ask investigation questions in plain language and returns correlated results across data sources.
• Governed and auditable. Every agent query and autonomous action is logged in Unity Catalog, creating a full audit and forensic trail. Lakewatch is currently in private preview.

What is an agentic SIEM and how does it work?

An agentic SIEM (security information and event management) applies autonomous AI agents to security operations. Rather than requiring analysts to manually write queries or work through floods of alerts, an agentic SIEM deploys agents that orchestrate threat detection, triage, investigation, and response across petabyte-scale security data. The operating model shifts security teams from "human-in-the-loop" to "human-at-the-helm," where analysts direct swarms of agents. At a high level, an agentic SIEM works by (1) unifying and normalizing security, IT, and business telemetry on an open lakehouse, (2) running detections as code against that data, (3) using AI agents to triage alerts into enriched incident summaries, (4) letting analysts investigate in natural language while agents autonomously hunt and correlate signals, and (5) recording every action for audit. On the Databricks Data Intelligence Platform, this is delivered through Lakewatch, an agentic SIEM built on an open security lakehouse.

Why Databricks Lakewatch delivers an agentic SIEM

• An open security lakehouse foundation. Lakewatch ingests and normalizes security, IT, and business telemetry at petabyte scale using open standards — OCSF (Open Cybersecurity Schema Framework), Delta, Parquet, and SQL — so agents can reason over complete historical depth without proprietary lock-in.
• Automated OCSF normalization. Disparate sources such as endpoint, network, identity, and cloud logs are normalized into a common schema automatically, and security events are correlated with enterprise context such as asset inventories and business data.
• Natural-language, agentic investigation with Genie. Genie is the conversational agentic interface. An analyst can ask, in plain language, for the authentication events of a user over the past seven days, the systems they accessed, related file-access events on sensitive data, and associated alerts — and Genie orchestrates agents that correlate the signals across sources in seconds and return a single response. See Genie and Lakewatch for SOC investigation.
• Automated triage. AI triage agents correlate cloud logs, identity signals, and business context to produce enriched, actionable incident summaries rather than raw alert floods. See alert fatigue is a business risk.
• Autonomous hunting. Agents autonomously hunt, summarize, and cross-reference petabytes of data in seconds, and can be built as production-ready AI agents with Agent Bricks.
• Detections as code. Security teams write detections directly against petabyte-scale telemetry, version-controlled and deployed through CI/CD pipelines.
• Governance and forensic trail. Every Genie query and autonomous action is logged in Unity Catalog, providing a full audit and forensic trail for compliance and post-incident investigation.

Lakewatch is currently in private preview. Capabilities described here are in active development and may change.

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM for the product overview.
• See how Genie powers SOC investigation in Lakewatch.
• Learn why alert fatigue is a business risk and how agentic triage addresses it.
• Explore Agent Bricks to build production-ready AI security agents.

FAQs

What makes a SIEM "agentic"?

An agentic SIEM uses autonomous AI agents to orchestrate detection, triage, investigation, and response, so analysts direct the work rather than running every query by hand.

What is Genie in Lakewatch?

Genie is the conversational agentic interface in Lakewatch. Analysts ask investigation questions in natural language, and Genie orchestrates agents that correlate signals across security, IT, and business data.

Is agent activity in Lakewatch auditable?

Yes. Every Genie query and autonomous action is logged in Unity Catalog, creating a full audit and forensic trail for compliance and post-incident review.

Is Lakewatch generally available?

Lakewatch is currently in private preview.