What is Databricks Lakewatch?

Summary

• An agentic SIEM. Databricks Lakewatch is an agentic SIEM (security information and event management) built on the Databricks Data Intelligence Platform.
• Open security lakehouse. It unifies security, IT, and business telemetry at petabyte scale using open standards — OCSF, Spark, Unity Catalog, Delta, Parquet, and SQL — avoiding proprietary lock-in.
• Autonomous AI agents. Genie and autonomous agents automate threat detection, natural-language hunting, triage, investigation, and response, so analysts orchestrate agents instead of hand-querying data.
• Governed and auditable. Every agent query and autonomous action is logged in Unity Catalog, creating a full audit and forensic trail.
• In private preview. Lakewatch is currently in private preview and designed to augment existing security operations.

What is Databricks Lakewatch?

Databricks Lakewatch is an agentic SIEM (security information and event management) built on the Databricks Data Intelligence Platform. It brings security, IT, and business telemetry together on an open security lakehouse at petabyte scale, then applies autonomous AI agents to automate threat detection, hunting, triage, investigation, and response. Lakewatch is designed to augment security operations, letting teams start with focused use cases and expand over time. It is currently in private preview.

Why Databricks Lakewatch

• Open security lakehouse. Lakewatch unifies security, IT, and business telemetry at petabyte scale using open standards — OCSF (Open Cybersecurity Schema Framework), Spark, Unity Catalog, Delta, Parquet, and SQL — so your security data stays open and governed rather than locked into a proprietary format.
• Petabyte-scale retention. By decoupling compute from storage, Lakewatch lets you retain months or years of high-fidelity telemetry and keep full historical depth available for detection and investigation.
• Automated OCSF normalization. Disparate sources such as endpoint, network, identity, and cloud logs are normalized into a common schema automatically.
• Agentic detection and response. Genie and autonomous AI agents automate threat detection, natural-language hunting, and incident response, so analysts orchestrate swarms of agents and receive enriched incident summaries rather than raw alert floods.
• Natural-language investigation. Security teams ask investigation questions in plain language and trigger autonomous agents to hunt and correlate signals across data sources. See Genie and Lakewatch for SOC investigation.
• Unified context. Lakewatch correlates security events directly with enterprise context such as asset inventories and business data, all on one platform.
• Governed by Unity Catalog. Every Genie query and autonomous action is logged in Unity Catalog, providing a full audit and forensic trail for compliance and post-incident investigation.

Capabilities described here are in active development and may change while Lakewatch is in private preview.

Common use cases

• Retaining high-volume telemetry, such as network and endpoint (EDR) streams, at petabyte scale
• Detecting and investigating AI- and agent-scale threats
• Correlating security data with business and application data in one platform
• Reducing alert fatigue through automated, agentic triage

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM for the product overview.
• Learn why alert fatigue is a business risk and how agentic triage helps.
• See how Databricks is reshaping the future of cybersecurity.
• Explore Agent Bricks to build production-ready AI security agents.

FAQs

What is Lakewatch?

Databricks Lakewatch is an agentic SIEM built on the Databricks Data Intelligence Platform. It unifies security, IT, and business telemetry on an open lakehouse and uses autonomous AI agents to automate detection, hunting, triage, and response.

What is "agentic" about Lakewatch?

It uses Genie and autonomous AI agents to orchestrate threat detection, investigation, and response, so analysts direct agents rather than manually querying data.

What open standards does Lakewatch use?

OCSF, Spark, Unity Catalog, Delta, Parquet, and SQL, so security data stays open and governed rather than locked into a proprietary format.

Is Lakewatch generally available?

Lakewatch is currently in private preview.