Databricks Lakewatch vs Splunk for enterprise SIEM

Summary

• Databricks Lakewatch is an agentic SIEM built on the security lakehouse. Databricks announced it on March 24, 2026 as launching in Private Preview, so confirm current availability and scope with Databricks.
• Lakewatch stores security telemetry in cloud object storage you control, in open formats such as Delta Lake or Apache Iceberg, and governs it with Unity Catalog.
• Splunk describes Enterprise Security as a unified threat detection, investigation and response (TDIR) platform integrated with agentic AI, SOAR, UEBA and SIEM. It is available as a service on Splunk Cloud Platform and can be deployed on premises.
• Both reference the Open Cybersecurity Schema Framework (OCSF): Lakewatch is built on it, and Splunk's Enterprise Security 8.x documentation lists a taxonomy aligned with it.
• We believe the better fit depends on where your security data already lives, how your team writes detections, and what you need available today.

Databricks Lakewatch vs Splunk for enterprise SIEM

Both are SIEM offerings for threat detection, investigation and response, built on different foundations. Lakewatch runs on the Databricks security lakehouse and stores telemetry in open formats in cloud storage you control. Splunk Enterprise Security is built on the Splunk platform, which stores events in indexes, and is available as a service on Splunk Cloud Platform or deployed on premises. We believe the better fit depends on where your security data already lives and how your team writes detections. Lakewatch launched in Private Preview, so confirm its current status first.

What is enterprise SIEM?

The NIST glossary defines a SIEM tool as an application that provides the ability to gather security data from information system components and present that data as actionable information via a single interface.

Databricks Lakewatch vs Splunk: how they compare

Area	Databricks Lakewatch (Private Preview)	Splunk Enterprise Security
Where it runs	Requires an active Databricks workspace on AWS, Azure or GCP and uses serverless compute	Available as a service on Splunk Cloud Platform; on premises, installed on a dedicated search head or search head cluster
Data storage	Cloud object storage you control (S3, ADLS, GCS) in open formats, including Delta Lake and Apache Iceberg	Events are stored in Splunk indexes
Ingestion and schema	Lakeflow Connect handles ingestion and normalization of major security sources into standardized tables; built on OCSF	Data flows through input, parsing, indexing and search; the Common Information Model maps data at search time; the 8.x taxonomy is aligned with OCSF
Detections	Detection as code: rules defined in YAML with SQL queries or Python notebooks, backtested against historical data and deployed through CI/CD pipelines	Detections generate the findings and finding groups that appear in the analyst queue; risk-based alerting is documented
Investigation	Genie translates natural language questions into SQL queries; Databricks describes Agent Bricks agents that triage alerts and summarize investigations	Investigations are built from findings, with response plans and automation through Splunk SOAR actions and playbooks
Search and query	SQL and Python in detections	Splunk's search processing language (SPL)
Access control	Unity Catalog: fine-grained access control at table, row, column and attribute levels, with auditability	Roles control the tasks users can perform, the data they can search and the resources they can access; Enterprise Security adds three roles

How Databricks approaches SIEM

Databricks describes Lakewatch as an agentic SIEM built on the security lakehouse, designed to unify security telemetry, IT logs and business data under a single governance layer. Per the launch blog, teams can store data in Delta Lake or Apache Iceberg in their own cloud storage and run queries across any cloud. Lakeflow Connect lands security logs, and Lakewatch normalizes them to OCSF. Databricks says Genie automates workflows such as parsing new log sources to OCSF, authoring detections from threat intelligence, and translating natural language questions into SQL. Unity Catalog governs all Lakewatch data for access control, data lineage and auditing.

How Splunk approaches SIEM

Splunk's Enterprise Security documentation says version 8.0 and higher provides a comprehensive threat detection, investigation, and response solution. Listed benefits include risk-based alerting, finding groups that map to rules based on common security frameworks, and automation with Splunk SOAR actions and playbooks. Enterprise Security is built on the Splunk platform and uses its search and correlation capabilities.

Which questions should drive the choice?

• Where does security telemetry live today? Lakewatch requires a Databricks workspace and keeps data in cloud storage you control. Splunk Enterprise Security keeps events in Splunk indexes.
• How does your team write detections? Lakewatch documents detections as code in YAML with SQL queries or Python notebooks. Splunk documents detections that generate findings for the analyst queue.

FAQs

Is Lakewatch generally available?

Databricks announced Lakewatch on March 24, 2026 as launching in Private Preview. This page does not assume a later stage, so confirm current availability with your account team.

Do I need Databricks to use Lakewatch?

Yes. Databricks says Lakewatch is a native application that runs on the Databricks security lakehouse and requires an active Databricks workspace on AWS, Azure or GCP.

Do both products use OCSF?

Databricks says Lakewatch is built on the Open Cybersecurity Schema Framework. Splunk's Enterprise Security 8.x documentation lists an aligned taxonomy with OCSF and industry standards as a benefit.

How are detections managed?

Databricks describes Detection as Code: teams manage detections as code, with automated testing and deployment so that every change is version-controlled and verified. In Enterprise Security 8.x, detections generate the findings and finding groups that appear in the analyst queue.

Can I run Lakewatch and Splunk together?

The materials cited here do not describe a joint deployment. A practical test is to send the same sample log sources to both and compare detection and investigation workflows.