Does Databricks have a SIEM solution for threat detection and response?

Summary

• Yes. Databricks offers Lakewatch, an agentic SIEM that unifies security, IT, and business data in a single governed lakehouse for AI-driven threat detection and response. It is in Private Preview.
• Retain months or years of high-fidelity telemetry at petabyte scale, giving AI agents the historical depth to detect complex, multi-stage attacks.
• Automated OCSF normalization maps disparate sources — endpoint, network, identity, and cloud logs — into a common schema for immediate correlation.
• Detection-as-code lets teams author detections in YAML with SQL or Python notebooks, backtest against historical data, and deploy through CI/CD; custom ML detections run on MLflow, Feature Store, and Model Serving.
• Analysts hunt threats in natural language, and every query and autonomous action is logged in Unity Catalog for a full audit and forensic trail.

Does Databricks have a SIEM solution for threat detection and response?

Yes. Databricks offers Lakewatch, an agentic SIEM that helps security teams defend against sophisticated threats by unifying security, IT, and business data into a single, governed lakehouse for AI-driven detection and response. Lakewatch powers a security lakehouse foundation, giving organizations a high-fidelity, open-data environment to operationalize an agentic security operations center (SOC). It is currently in Private Preview. See Databricks announces Lakewatch, a new agentic SIEM.

Why Databricks Lakewatch for threat detection and response

• Unified security lakehouse. Collect, govern, and analyze petabyte-scale security telemetry alongside IT and business data in an open lakehouse format, and correlate security events directly with enterprise context such as HR records, asset inventories, and business data. See Alert fatigue is a business risk.
• Petabyte-scale retention. Retain months or years of high-fidelity telemetry, giving AI agents complete historical depth to detect complex, multi-stage attacks that unfold over long periods.
• Automated OCSF normalization. Automated OCSF mapping normalizes disparate data sources — including endpoint, network, identity, and cloud logs — into a common schema so events can be correlated immediately.
• Agentic triage and threat hunting. Orchestrate agents that autonomously hunt, summarize, and help neutralize threats in natural language at machine speed, with humans at the helm for oversight.
• Detection-as-code. Define detection rules in YAML with SQL queries or Python notebooks, backtest them against historical data, and deploy them through CI/CD pipelines. Genie Code can help automate ingestion, author net-new detections, tune rules to reduce false positives, and translate natural-language questions into SQL.
• Custom ML detections. Train and deploy machine learning models directly on security data using MLflow, Feature Store, and Model Serving for anomaly detection, behavioral analytics, and entity risk scoring.
• Natural-language threat hunting. Genie lets any analyst run complex, multi-step threat hunts in natural language without learning a specialized query language. See AI/BI Genie.
• Governed forensic trail. Every Genie query and autonomous action is logged within Unity Catalog, providing a complete audit and forensic trail for regulatory compliance and post-incident investigation.

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM for an overview of the product and how it changes security operations.
• Review Alert fatigue is a business risk for the agentic SOC approach to detection and response.
• Lakewatch is in Private Preview — work with your Databricks account team to request access.

FAQs

What is Lakewatch?

Lakewatch is Databricks' agentic SIEM. It unifies security, IT, and business telemetry in a governed lakehouse and orchestrates AI agents to hunt, summarize, and help neutralize threats, with humans overseeing the response.

Is Lakewatch available today?

Lakewatch is in Private Preview. Work with your Databricks account team to request access.

How does Lakewatch normalize different log sources?

It uses automated OCSF mapping to normalize disparate sources — endpoint, network, identity, and cloud logs — into a common schema so events can be correlated immediately.

Can teams write and test their own detections?

Yes. Detection-as-code lets teams author detections in YAML with SQL or Python notebooks, backtest them against historical data, and deploy through CI/CD, and build custom ML detections with MLflow, Feature Store, and Model Serving.