How do AI agents automate security incident triage?

Summary

• AI agents automate security incident triage by enriching raw alerts with context, assessing indicators, and correlating signals into incident summaries — so analysts review decisions instead of every alert. On Databricks this is delivered by Lakewatch, an agentic SIEM on the open Data Intelligence Platform.
• It starts with data: security, IT, and business telemetry is unified at petabyte scale and automatically normalized to the OCSF schema, giving agents complete, correlated context.
• Detection-as-code in a streaming pipeline generates alerts, then source-specific triage agents — each tuned to one alert source — enrich them, and a dedicated Threat Intelligence agent assesses whether an indicator is known malicious, unknown, or benign.
• In Databricks' own security operations, 17 source-specific triage agents saved over 6,500 analyst hours in the first 30 days by automatically enriching and resolving low-severity alerts.
• Every autonomous action is logged in Unity Catalog for a full audit trail. Lakewatch is in Private Preview.

How do AI agents automate security incident triage?

AI agents automate triage by taking over the repetitive work between an alert firing and an analyst deciding what to do: they gather context, assess indicators, correlate related signals, and produce an enriched incident summary. This shifts the security operations center from a "human-in-the-loop" model to a "human-at-the-helm" model, where analysts direct agents rather than hand-processing every alert. On Databricks, this is delivered through Lakewatch, an agentic SIEM built on the open Data Intelligence Platform, where triage runs as an automated pipeline over governed security data.

How Databricks Lakewatch agents automate incident triage

• Unify and normalize the data. Lakewatch unifies security, IT, and business telemetry at petabyte scale on an open lakehouse and automatically maps endpoint, network, identity, and cloud logs to the OCSF (Open Cybersecurity Schema Framework) schema, so agents reason over a single correlated view.
• Generate alerts with detection-as-code. Detections live in a Spark Structured Streaming pipeline as code with windowed aggregates, enabling sub-minute alert evaluation rather than static dashboard queries.
• Enrich with source-specific triage agents. Instead of one general-purpose agent, each alert source has its own triage agent tuned to that source, applying deterministic filtering and automated contextual enrichment in real time. See Scaling security alert triage with specialized agents.
• Assess indicators with a Threat Intelligence agent. A dedicated Threat Intelligence agent sits alongside the triage fleet and can be called by any agent to determine whether an artifact or behavior is known malicious, unknown, or benign.
• Correlate into incident summaries. Agents correlate signals across security, IT, and business data and roll raw alerts up into enriched incident summaries analysts can act on in seconds.
• Proven at scale. In Databricks' own security operations, 17 source-specific triage agents saved over 6,500 analyst hours in the first 30 days by automatically enriching and resolving low-severity alerts.
• Governed and logged. Every autonomous agent action and every AI/BI Genie investigation query is logged in Unity Catalog, providing a full audit and forensic trail.

Lakewatch is available in Private Preview.

Getting started

• Read Databricks announces Lakewatch: a new, agentic SIEM for the end-to-end architecture.
• Read Scaling security alert triage with specialized agents for how the triage agents are designed.
• Read Alert fatigue is a business risk for why automated triage matters.

FAQs

What steps does an AI agent take to triage an alert?

It enriches the alert with context, calls a Threat Intelligence agent to assess indicators, correlates related signals across data sources, and produces an enriched incident summary for analyst review.

Why use source-specific agents instead of one agent?

Each alert source has different context and patterns, so an agent tuned to a single source enriches its alerts more accurately. In Databricks' own SOC, 17 source-specific triage agents saved over 6,500 analyst hours in the first 30 days.

How is the automation kept auditable?

Every autonomous action and investigation query is logged in Unity Catalog, giving a full audit and forensic trail for compliance and post-incident review.