Introducing Lakewatch

Summary

Lakewatch is Databricks' open, agentic SIEM that unifies 100% of security, IT, and business telemetry in a single governed environment using open formats and Unity Catalog, with no data duplication or vendor lock-in.
Embedded AI agents powered by Genie Code automate threat detection, hunting, and response at machine speed to counter AI-driven cyberattacks that move faster than traditional SOC triage workflows.
Traditional SIEMs force costly trade-offs between data volume, retention, and cost; Lakewatch builds on the existing Databricks Data and AI platform investment to eliminate those trade-offs for security teams.

Introducing Lakewatch

Cyberattacks are no longer just human-operated. AI-driven threats now move at machine speed, exploiting gaps across systems while your SOC is still triaging yesterday's alerts. Traditional SIEMs weren’t built for this reality: they force painful trade-offs between data volume, retention and cost, leaving security teams flying blind with only a fraction of their telemetry in view. In this video, we’ll take you inside Lakewatch, Databricks’ open, agentic SIEM built for machine-speed defense. We’ll start with the “why”: what motivated us to build something fundamentally different. Then we’ll demo how Lakewatch unifies 100% of your security, IT and business telemetry in one governed environment using open formats and Unity Catalog, with no costly duplication and no vendor lock-in. You’ll see how embedded AI agents powered by Genie Code automate threat detection and response at machine speed, and we’ll close with an exclusive peek at the roadmap and what’s coming next. Whether you’re evaluating your current SIEM, dealing with runaway data costs or looking to modernize your SOC on your existing Databricks investment, this video is your practical starting point. Key takeaways: Why traditional SIEMs structurally fail against AI-driven threats How Lakewatch unifies all your telemetry with open formats and Unity Catalog How Genie agents automate detection, hunting, and response A first look at the Lakewatch roadmap and what’s coming next
Talk By: Keegan Dubbs, Staff Product Manager, Databricks ; Molly Limaye, Associate Product Manager, Databricks ;

Chapters

FAQs

What is Lakewatch and how does it differ from traditional SIEMs?

Lakewatch is Databricks' open, agentic SIEM built to address the structural limitations of legacy security information and event management tools. Unlike traditional SIEMs that force trade-offs between data volume, retention, and cost, Lakewatch stores 100% of telemetry in open formats with no vendor lock-in, governed through Unity Catalog.

How does Lakewatch use AI agents for threat detection?

Lakewatch embeds AI agents powered by Genie Code to automate detection authoring, threat hunting, and incident response at machine speed. This agentic approach enables the SOC to counter AI-driven attacks that operate faster than human-operated triage workflows can respond.

Does Lakewatch require a separate data platform?

No — Lakewatch is built directly on the Databricks Data and AI platform and Unity Catalog, so organizations can unify security, IT, and business telemetry within their existing Databricks environment. This eliminates costly data duplication and allows security teams to leverage the same governed infrastructure already used by data and ML teams.

What does detection authoring look like in Lakewatch?

Lakewatch supports Genie-assisted detection authoring via natural language, with detections backed by YAML and integrated with CLI and Git workflows. This enables security engineers to create, test, and version-control detection rules without leaving their existing development practices.

Full transcript

[00:07] Well, thank you everyone for coming and hopefully you did just see a sneak peek of Lakewatch in the keynote and we're going to go into a little bit more depth about what Lakewatch is, how customers are using it today and how you can get access. So, you've probably seen this a
[00:22] million times. Um, but we are required to just show you the forward-looking statement in relation to anything that would be roadmap facing. Um, we this just protects any of the claims that we make. So, quickly, let's introduce
[00:35] ourselves. So, I'm I'm Keegan. I'm the product lead on Lakewatch. And in prior lives, I've been a product manager at Splunk, Slack, as well as Amazon. and I've kind of always owned different features that are related to identity,
[00:48] security, and observability. Um, and honestly, I know this is cheesy, but the best part of my day as a PM is when I get to talk to customers like yourselves. And that's why we're super excited to show you what we what we have
[01:00] with Lakewatch here today because none of this would have been feasible without customer feedback. >> Hi everyone, I'm Molly Lame. I'm a product manager on Lakewatch. I've previously worked at Palatoto Networks and Rubric and it's been super exciting
[01:13] to work on Lakewatch to help customers leverage the data bricks platform for new use cases in cyber security. We're really excited to share with you what we have today and Molly's in even more customer meetings than I am. Um, which
[01:25] is a lot. So, so first let's just do a quick agenda on what we're going to cover. Um, first we'll double click more into what you may have seen of Lakewatch in the keynote. Then we'll cover some of
[01:37] the different features and functionality in the product that that is different from what you see in the traditional SIM tools. We'll talk about um one of the key use cases that we've been hearing from both our DIY SIM customers and the
[01:51] Lakewatch private preview customers. Um and then we'll give you a little insight into the road map and where we're going next and how you all can get access to lakewatch. So with that, I would love to get a sense of kind of who you all are
[02:05] in the audience. So if we could do maybe just a show of hands, how many of you yourselves would you consider yourselves to be security practitioners or security experts?
[02:19] Okay. Okay. This is more than I thought. We were we were um ex This is great. We have were potentially expecting that it would be a lot more of the uh data engineering folks um that would might sit adjacent to security although we
[02:31] know obviously the whole organization works works very closely together. So um the reason why I asked is as you heard from Andrew in the keynote whether you're securing the the platform or
[02:43] you're building it what's coming related to AI is changing the game for all of us and the security landscape has fundamentally shifted. We're facing this title wave of agentic attacks. So behind
[02:55] me on the screen are just a few headlines from the last couple months. And the thing to know is that these aren't research demos. They're real. So take for example the anthropic disclosure where a state sponsored group
[03:08] got an AI agent to run an entire espionage campaign against dozens of companies and and the AI did most of the work itself. or the Claw Hub campaign which basically scared everyone off of
[03:21] using OpenClaw where they had that malware was actually embedded and hidden in the skills for the agents. So folks were invoking these agents in these skills and basically bringing malware
[03:34] into the organization without even realizing they had done it. And all of this is the same thing, which is they're different attacks, same story that the attackers have shifted from being human- le to now being more auto automated. Um,
[03:48] and on defense, we're basically still doing things by hand. But, you know, this is interesting if we don't just look at the news headlines. Let's look at this from a datadriven lens. So less than 5 years ago, actually when I was at
[04:01] Slack, less than 5 years ago, the time from a uh vulnerability being introduced to it being exploited was on the scale of months, if not years. This meant that
[04:13] you seemingly had ample time to monitor, find vulnerabilities, patch the issue before an attacker could ever exploit it. But where it gets interesting is right around where on the screen where
[04:25] it turns orange is you start to see with the introduction and advent of AI that that time to exploit starts to dramatically actually exponentially decrease. And where we are today is the
[04:38] time the average time to exploit is something like on the scale of one and a half days and we've seen recent reports where that's closer to the scale of hours. So all of this means that cyber attacks are running at a gentic speed
[04:52] and that attacks are becoming more frequent and more dangerous. But let's talk about why this matters now. Because for the tools that most teams lean on, the legacy SIM was never
[05:04] built to support this world. And it breaks down effectively in three different ways. First of all, your SIM tool is often separate and siloed from other parts of your organization and from the rest of the data lake. So your
[05:17] security team is effectively operating in a separate silo and a lot of the different SIM tools like PaloAlto, Crowdstrike, um Splunk use proprietary format. So once your data is in there,
[05:30] it's basically locked in there and you're not able to access it with with other tools. The second is that the vast maj majority of these tools were built a decade or longer ago, which means that
[05:42] the analytics and AI capabilities are all effectively bolt-on rather than being native to the system themselves or native to the platform themselves. And the third and probably most important
[05:54] thing and the thing we hear basically daily from customers is the cost and scalability a aspect which is many of these tools charge based on ingest. We've all experienced a massive increase
[06:07] in the amount of data that our organization and our businesses are are creating. And so what that means is that the scale of the business data growth um scale also scales up with the costs and it just becomes untenable for for
[06:20] customers to be able to actually ingest all everything they want into their SIM tool. So what does this actually look like in practice? So, what we're seeing and hearing from customers is that they're doing a couple different things
[06:32] just to try to work around some of these cost and retention issues. So, they might be sending, let's say, a really narrow window of seven, maybe 30 days worth of data to the SIM tool and then
[06:44] they're throwing the rest of it away. So, you only have like a very narrow window where you're looking at the the real-time monitoring and alerting. Or maybe a customer has stood up some type of like data filtering, data forwarding
[06:56] upfront in the data pipelines to try to do transformations, trim, basically throw away the nonimportant data and just throw that directly into the into
[07:08] the trash or or leave it behind. And then what's not shown here is that there's also all sorts of data sources that are not even really well supported in traditional SIM tools today. Andrew actually spoke to this in the keynote
[07:20] being things like your different Slack messages or this can be the chat history with LLMs. That's not easy for a traditional SIM tool to ingest. So all this adds up to basically tons of blind
[07:32] spots in your organization and in practice you can't defend what you can't see. So all of this is why we feel that data bricks and uh lakewatch is uniquely
[07:44] positioned to offer a different approach. We call this the open security lakehouse and which lakewatch is built on top of. So the first pillar is unification. Send us all of your data in
[07:58] any format and this is in the single governed lakehouse foundation. So you can unify your security, your IT and your business data in one one space and then govern it all with Unity catalog.
[08:10] The second is that we have not only customizable but we also have AI native security. So you can either sorry AI native um security agents. So what that looks like is you can either leverage
[08:23] the agents we have out of box with genie and genie code which have been trained on uh lakewatch and security information or you can actually leverage uh some of the the data bricks platform features to
[08:36] build your own or create additional agents custom agents on top of the data that's in your security leakhouse. And the last and probably most important pillar is all around the scalability piece. And this is how you dramatically
[08:49] reduce TCO and enable long-term retention. Because of the data bricks architecture that we fundamentally have the separation of compute and storage, you're not needing to make the the difficult trade-offs of what data do I
[09:02] send to my SIM. Just send it all to the to the uh security lakehouse and then only use what you need once it's there. And this is exactly what Lakewatch does.
[09:14] So Lakewatch is data brick's new security lakehouse product. It lets you bring data in from multiple sources as well as leverage any data that you already have in Unity catalog in your
[09:26] security lakehouse. It then helps you normalize that data through silver and gold to an OCSF format. So that let's say if you have data coming from multiple different IDP tools like from
[09:39] octa as well as entra all of that is normalized uh in the same way making it easier to have the data be consistent for detection monitoring and investigation and lakewatch was purpose-built for detection engineering
[09:52] and security operations teams and it speeds time to value for leveraging your security lakehouse as an open agentic sim and one last thing on this is that customers have been doing this with
[10:04] using data bricks as a platform for years. Lakewatch really just speeds all of that time to value of making it easier for you to get a lot of the same value that that we've heard from customers um in in the last you know
[10:17] half a decade. So I expect that many of you are familiar with the data bricks architecture um since you're here at the conference and and our data bricks
[10:29] customers. So let's sit talk about um where lakewatch sits within the data bricks architecture. So lakewatch touches and consumes all parts of the data bricks stack and we tend to talk about three core customers.
[10:43] So the first is all around ingest or just getting you know getting data in but this can also be data that you already have in data bricks today. The second is what I had talked about with the parsing and normalizing. This is
[10:56] leveraging the medallion architecture and ETL presets to normalize the data to OCSF. And third is detection and investigation. This can take many forms from detection rules to pivoting and
[11:09] analyzing in the search query UI which is custom and native to to to Lakewatch and separate from the DBSQL UI. Did it move forward? Um the big thing here is that Lakewatch isn't a new tool
[11:22] to learn. It's native to data bricks and so that means that it is just data bricks pointed at your security data and information but you know you don't have to trust me we actually have tons of customers who
[11:34] are already using data bricks as their security lakehouse today so for example capital one um they actually bring together massive amounts of identity cloud and security telemetry into their
[11:46] security lakehouse then they're able to establish behavioral baselines for all of their employees employees as well as for the service accounts. And then they can flag different uh anomalies and such
[11:58] as unusual data access, anything that's off hours activity or unexpected privilege escalation that may be indicators of a threat or compromised credentials. And the foundation of this
[12:10] is all because of the the insights driven by the security leakhouse. So let's go back to those three pillars I talked about just a few slides back and kind of double click into why data
[12:23] bricks is uniquely positioned to do this because security is fundamentally a data and AI problem and that's exactly what this platform was built for. Three things matter. It's scalable so you can
[12:35] keep all of your data not a filtered subset. It's agentic so you can fight agents with agents and uh it's one copy of your data and so now let's double click into each of these starting with
[12:47] unified. So there's already a ton of security relevant data in your your data bricks lakehouse and lakewatch makes it really easy to bring in net new data sources as well. And then once your data
[13:00] is in the lakehouse you can do all sorts of either detections on top of that or threat hunting longerterm analytics either human-driven or agentic. And when we say unified here's what it actually
[13:12] buys you. It gives you the ability to detect across all of your data because it's already sitting in one place. And this one is especially for the platform and data teams in the room. And let's show you how you can solve this problem.
[13:25] First, here's how, at least from the customers that we've been talking to, a lot of your security stacks look today. Your SIM is actually an island that's sitting completely separate from your data
[13:37] lakeink. So you may need to stand up some type of routing tool to actually send two different copies of the same data to both of those tools. So this means that you're effectively paying
[13:49] twice. Well, you're paying for the routing tool as well, but you're paying twice to ingest, index, and store the same data in two different locations. And your security team basically ends up operating in a silo away from the rest
[14:01] of the data or so. So you've got two copies of the data, two bills, and one siloed team. So this is the thing that we set out to fix and the fix is pretty simple as I mentioned you probably have
[14:14] a lot of security relevant data already in data bricks but what we're saying is just land the data once in your lakehouse and lakewatch makes that easy so we have multiple different modes for ingest you know first is that we've
[14:26] worked with our lakeflow connect team that we've got all sorts of managed connectors out there for the different SAS tools like octa crowdstrike and slack um we also support onboarding data from cloud storage locations and have a
[14:39] very friendly UI to leverage autoloader under the hood so that you don't need to be a data engineering expert and then we coupled with our uh zerobus team so that you can push uh any of your data to the
[14:52] zerobus endpoints or use the kafka kinesis and event hubs extensions that are are part of the data bricks platform and as I mentioned now multiple times don't ignore the very valuable data that
[15:04] you probably already have potentially for other use cases that's already in UC. So once your data is in the lakehouse in the unified lakehouse, now there's two things that you can do with it. And
[15:17] because it's all in one platform, they basically reinforce one another. So on the detect side, what this actually looks like is let's say that you wanted to catch privilege access abuse. So you write one detection over your data
[15:30] bricks audit logs and that fires when a user grants themselves elevated permissions. And because your data is unified, you're actually able to enrich it. And so let's say you can take your data bricks audit logs, join it with
[15:43] your cloud trail data and your CMDB data so that it only escalates or creates an alert if the identity touched then touched one of the crown jewel systems. So you're basically getting like more effective detection and alerting by
[15:56] doing the enrichment first um within the the unified lakehouse. And that's a detection that a standalone SIM can't write because it doesn't necessarily have all of the other data sitting alongside it. And on the analyze side,
[16:10] your threat intel feeds can flag a new malware C campaign that maybe hit came out this morning. And normally an analyst would spend a ton of time to do research, create the different uh
[16:22] queries in order to investigate if you are vulnerable to that malware. That's the type of thing that now you can ship off to Genie have run either in the background or alongside and what what would have taken weeks or days now only
[16:36] takes a few minutes to get a response um uh multi- multi-stage hypothesis response from Genie. So it's the same data, same platform and for both detection engineering and investigation
[16:48] side by side. So let's double click a bit on the detection piece because this is another thing that we've heard from many of the customers we're working with in private preview is they want detection as code and in lakewatch you
[17:02] can actually author detections in three different ways and you can mix and match them. So if you want to just author the detection in the UI, you can do that. And we support creating the detections either as just inline SQL or if you have
[17:16] more advanced logic, you can actually have that the detection itself is a data bricks notebook. So you can leverage Python or any other language and then the detection scheduling will run that notebook on the schedule um that's set
[17:30] uh for the specific detection rule. Second is that you can actually author these detections agentically. Um, which to be honest is the only way that I write detections anymore in our demo environments. Um, so for example, I have
[17:44] um our Slack audit logs coming through and I worked with Genie to create a detection to let me know um anformational alert for any time that someone was granted a workspace admin or
[17:56] account admin privilege in in from the the Slack audit logs. That's normally a SQL query I would have probably had to like I don't know Google and and piece together myself. Genie came back within
[18:09] a matter of minutes with that recommendation. I was able to put it into the detection and then tune tune the detection with Genie. So that's agentic authoring. And then the third and probably most important is that all of our detections are backed by YAML and
[18:23] you can see that in the UI but you can also access those YAML files through uh the the the lakewatch CLI. So what that means and what we have many of our customers doing is in combination with the access controls we have within
[18:36] lakewatch that can give you that everything is entirely only accessed and authored through the backend or through the CLI so that you don't get any fat fingering issues in the UI and every all all of the source of truth of your
[18:49] detections can remain in a repository upstream like git or whatever is the repo of choice.
[19:02] leakhouse and then either author detection rules on top of it or start some investigation using the Lakewatch query UI. So I'm now going to hand it to Molly who's going to discuss our second two pillars. The first one on agents.
[19:16] Thanks, Keegan. So back to the problem we opened with. Attackers now move at machine speed. In the past, when a new security flaw was discovered, defenders had a gap. Days,
[19:29] weeks, even months to fix it before anyone could take advantage. But today, that gap is gone. The moment a flaw becomes public, AI powered attackers can build a working attack within hours or
[19:42] even minutes. Meanwhile, your security team might still be working through yesterday's alerts, tens of thousands of cases per month against just a handful of analysts. You simply cannot fight an
[19:55] attacker moving at machine speed with a team who's moving at human speed. So, the attackers are bringing the AI agents. Lakewatch can bring AI agents, too. Lakewatch puts agents to work
[20:07] alongside your team to handle the sheer volume of data, searching across your data for context, and taking the first look at every case so your analysts can keep pace with the threats. Let's show
[20:19] you. Threat hunting today is a manual slog. One hunt is a multi-step investigation. you rehydrate your data, pull intel feeds, extract indicators, write
[20:32] queries, run them, maybe pivot and start all over again. This can take days or even weeks for a single hunt. And this is not a hypothetical scenario. This is what real customers have told us
[20:44] directly. A security architect at a government-owned energy and utilities provider said that their analysts spend half a day just getting this process set up before the real hunting even starts.
[20:56] So here's a question. What if all of that, the feeds, the indicators, the query writing, the pivoting, starting over collapsed into a single question asked in plain English? This is exactly
[21:09] what you can do with agents in Lakewatch. This is where Genie comes in. Instead of days of setup, the analyst simply asks the question in plain English. No SQL, no query writing, no debugging syntax
[21:22] errors. And Genie translates that question into code that runs against your data. What makes it work is that Genie actually knows your environment, your schemas, your lineage, your
[21:34] context, your tables. Because of that, Genie often understands your data better than you do. And that's how it can surface threats and exposures you might not even know that you had. Let me give
[21:46] you a real example from a large postal agency in AMIA who's currently using Lakewatch. They asked Genie code a plain English question. No query language, no detection rules. They just said to
[21:59] Genie, "Show me unusual authentication activity." Genie surfaced source IPs with 900,000 off attempts over three weeks, each authenticating as hundreds of distinct users. That pattern means
[22:12] you're looking at load balancers or off proxies, devices that front authentication for the entire org. But the kicker, the customer didn't even know that they had these. And if an attacker finds one of those proxies
[22:24] before you do, they have a single point to intercept or relay credentials for thousands of users. And until Genie surfaced them, the customer didn't even know they were there to protect. So this
[22:36] discovery happened just because they asked Genie a simple plain English question to look for any unusual authentication activity and Genie found a vulnerability they didn't even know that they had.
[22:49] There's also the main day-to-day of the analyst job, the thousands of cases and alerts coming at your team every single day. And that's where this same machine speed problem shows up as a volume
[23:01] problem. Here's the math. Every sock lives with tens of thousands of cases per month divided by just a handful of analysts means your analysts are overloaded with alerts and the clock is
[23:14] unforgiving. One of our private preview customers told us their sock team is held to an SLA of just hours to respond to an alert. Now factor in these agentic attacks and that alert storm only gets
[23:26] worse, but the SLA stays the same. To put the scale in perspective, Adobe told us that their SIM alone generates tens of thousands of alerts, far more than any team could ever review by hand. And
[23:39] they really only need to look at one to two thousand of them. So, you can't hire your way out. This gap is in the orders of magnitude. So, the real question is, how do you manage these cases when the
[23:51] threats are just multiplying every day? And what if an agent could take a first look? With Lakewatch, Genie Code can be your first line of defense. It can take the first look at every case. Not a sample,
[24:05] not just the top of the queue, every single one. First, Genie reads the case and automatically pulls in the related data an analyst would normally go looking for across tools. Then, Genie
[24:17] investigates in plain English. No query writing, no pivoting between consoles to find more data or more context. Just a few minutes, Genie can hand back a clear summary of the case, plus recommended
[24:30] next steps. So, the human analyst doesn't walk into a raw alert. They walk into a case that's triaged and ready for action. Instead of burning the first 20 minutes or even hour getting context on
[24:45] the case that could turn out to be nothing, the analyst can then spend their time deciding and responding on the cases that actually matter to their org. And because Genie can scale to every case, your analysts aren't rushing
[24:58] to handle cases that require much more comprehensive investigation just to meet these SLAs's where threats or vulnerabilities could be getting missed. On the screen, you can see Genie code in action. Looking at a case, this was
[25:12] anformational case, so an analyst might just do a quick scan because it's not classified as high severity. But Genie Code took a first look at this case, looked at the event details, saw that it
[25:24] was a suspicious API request. It then looked at the data context in the lakehouse to understand what does this API endpoint do and what's the significance. It then checked threat feeds to see if this is a known malicious IP address and looked through
[25:38] the codebase and found a backd dooror in the code that skipped the alle checks and returned a decryption key directly. Genie then used logs to check who at the org introduced this back door into the code and which Jira tickets was this
[25:51] employee assigned to see if this was something the employee was meant to be doing. Then Genie also was able to check the HR data in the lakehouse in data bricks and see who the employees manager is, what team they're on, and what
[26:04] assigned work they're supposed to be doing. Genie was able to compile a full report of this incident in just a few minutes, summarizing the change, who introduced it, and all of this context that it pulled. And so, Genie was able
[26:16] to pull across data in the lakehouse and surface valuable insights for a case that was originally labeled asformational and may have been breezed over by a busy sock analyst drowning in thousands of cases.
[26:28] Therefore, Genie provides the native agentic layer in Lakewatch, able to pull across your unified data lakehouse to pull in valuable context, saving your sock analysts time and resources and
[26:40] helping them surface threats even faster. So, that was the agentic pillar. Now, we can talk about our third pillar, scalability for unlimited retention.
[26:52] None of what we just showed you actually works if you can't afford to keep all of this data context in your lakehouse. So this is the last pillar scale. Lakewatch
[27:04] is built for teams drowning in data volume and cost which I'm sure if you asked your CISO is pretty much all of you. Our promise is to stop choosing
[27:16] what data to ignore. Stop filtering out valuable context and information. With Lakewatch, you can keep 100% of your telemetry across weeks, months, or even
[27:28] years. So, remember the problem Keegan raised at the start. We talked to a lot of you, and here's what we keep hearing. You're standing up entire separate tools, data filtering products just to trim down
[27:41] your logs before they reach your SIM so that you can add more without making your cost skyrocket. Think about what that means. The SIM structure is so broken that you're adding yet more tools that you have to
[27:55] stand up, manage, and monitor in your pipeline just to make the SIM that you're already paying for usable at a larger scale. And the reason comes down to how these tools are priced. Paybyte SIMs force two trade-offs.
[28:09] First, you're ingesting only a small percentage of your data, maybe five or 20%. Second, you're retaining it for days instead of months or even years. So
[28:21] 80 to 95% of your data is dropped or moved out of your SIM. And that could easily be where the threats are hiding in the sources that you didn't ingest or the history that you aged out. And this
[28:34] never ends. Every new source, every extra day of retention is another budget fight. One of our customers, NAB, put it plainly. They said we want to collect and analyze all of our data, not just a
[28:47] filtered subset. But on this per bite model, that's economically impossible. So how does Lakewatch let you keep 100% of your data and actually scale with it?
[29:00] This is the security lakehouse architecture. The data bricks lakehouse architecture. Two things make it work. First, open formats delta or iceberg sitting in your own cloud storage. So
[29:13] there's no proprietary format and no lock in. Second, compute is decoupled from storage. So adding more data doesn't mean a bigger ingestion bill. Storage scales on its own and you only
[29:27] spin up compute when you actually use it. That's the unlock with Lakewatch. You keep everything and scale to pabytes. And the more data you bring in, the more visibility you get. Instead of
[29:40] being forced to leave sources, data context, and history on the cutting room floor. It's not just the data that scales. Your detection logic scales with it. With Lakewatch, everything is code under the
[29:54] hood. Your detections are YAML and SQL, version controlled in your own git, and so are your data pipelines. That means you can manage and evolve your pipelines like software. Schema changes are easy
[30:06] to make and easy to revert. Everything is version controlled and nothing is trapped inside a proprietary tool. There's no lock in on your data, no lock in on your pipelines, and no lock in on your detections. This gives you complete
[30:20] visibility across all of your data silos. But you don't have to hear it from me, hear it from these customers. Lakewatch's value is proven across industries. Some highlights I want to
[30:32] point out. With data bricks for their security data, standard chartered saw 72% lower cost and 80% faster time to detect. Rivian saw 60% sim cost cut and
[30:45] onboarded over 130 sources in just four months. Adobe, a customer that I meet with weekly, is running 21 pabytes of telemetry and 14,000 queries per day
[30:57] with Lakewatch. And NAB, another one of our design partner customers, is seeing 27 times faster indexing in Lakewatch, taking a job from 20 hours down to just
[31:09] 45 minutes. The through line across all of these customers is that they're seeing much lower TCO compared to their legacy SIM with not only no loss of coverage, but actually increased coverage across more
[31:23] data due to the data bicks architecture. Their security monitoring scales, so they can keep everything with Lakewatch and data bicks. These customers are already living the advantages of Lakewatch and the data bicks platform. A
[31:37] gentic defense that moves at machine speed across unified data in a lakehouse that scales to let you keep 100% of your data. That's the Lakewatch vision and it's real today for these customers and
[31:51] many more. Now that we've shown you the value that Lakewatch delivers, I'll hand it back to Keegan to show you the product capabilities in action. >> Thanks, Molly. Um so yes so now that we've covered some the three different
[32:03] pillars that we wanted to talk about the unified the agentic the scalable nature we wanted to talk through one of the different use cases that we have several of our private preview customers using lakewatch for today. So we've shown you
[32:15] why this why this all matters and what makes lakewatch different but let's go through a concrete example of how would you use lakewatch to actually secure data bricks itself. So, here's a pattern that we see
[32:28] consistently is that teams are actually taking their data bricks audit logs. Um, stuff like who logged in, who touched what, who changed a permission. Um, and they're actually shipping that off to another SIM tool. So, they're needing to
[32:41] set up, it's ironic, they're needing to set up a data pipeline from data bricks to another tool or system. So they're paying for that transport, those pipelines, that ingest to monitor the
[32:53] data that never a actually needed to leave data bricks. So it's a tax to watch your own platform. And it's not just audit logs. When you really look, there's a ton of security relevant data
[33:05] already in your lakehouse. Some of you definitely have it because it's data bricks native. the stuff like the audit logs, the system tables, billing, soon to be things coming off of the AI gateway that you saw from Casey earlier
[33:18] today in the keynote. Um, but there's also realistically a lot of other data that maybe you already have ingested, whether that's cloud trail, octa, whiz. The point is that the fastest security
[33:30] win isn't necessarily a new pipeline. It's probably the data that you already have in data bricks. So let's walk through how easy this is to do within Lakewatch in three quick steps. So the
[33:44] step one for any of these use cases is ingest except for this use case there is actually nothing to ingest because the audit logs are already native to Unity catalog. So what you can do is you can
[33:58] actually make them richer. Let's say if you wanted to join them with cloudt trail or tag them with the asset context from whiz or your cmdb so that a permission granted event joined with the cloudt trail trace gives you the full
[34:12] crosscloud action chain and it will let you see and flag if a if someone touched a crown jewel system. There's no pipeline to build. You're just enriching the data that you already have in data bricks. Step two is detection. And here
[34:26] you don't actually start from a blank page. We talked a few slides back about the multiple different ways to author detections, but we also within leakwatch ship outofthe-box rules that you can just grab and import and bring into your
[34:40] environment. And these were actually written by one of the data bricks sec ops engineers who joined the lakewatch team. And there's 31 different rules that you can grab. Um, actually the one that I have on the screen is the truffle
[34:53] hog login one. And then I went and used Genie to tailor that detection to help me add observables to the detection. Um, which was SQL logic that I didn't need to write myself. So you start from a
[35:05] template and then you let Genie make it yours. And then step three is investigate. So those detections will fire and then produce notables which ultimately become cases. And here's where it gets powerful. You can just ask
[35:19] Genie to investigate the case. It will aggregate all of the case info, form a hypothesis, kick off a research agent, and it will connect all of the evidence into one story. So instead of an analyst
[35:32] stitching together 200 different alerts by hand, they're reviewing a narrative for accuracy, and that's the agentic sock in practice. And really, that's the whole thing. In three easy steps, you
[35:44] can enrich the data you already have, grab a detection and uh from a template and make it your own and then investigate the cases with Genie. That's how easy it is to stand up Lakewatch as
[35:56] a SIM to monitor data bricks itself. No migration, no new pipeline, one platform that you already run. So let's zoom back out. That's Lakewatch. We covered that lakewatch is
[36:09] scalable. You can keep all of your data. It's unified with one platform, one copy, and it's agentic. It allows you to finally fight agents with agents using genie, a code for natural language
[36:22] threat hunting. So, it's a a sim that bolts AI on the Sims that bolt AI on later just can't get here. And this was built with it from the start. But I do want to give you Oh, I think we lost a
[36:35] slide. There was we did want to give transparency on where we are with the product today. Um what I was going to call out is that the lakewatch today is in a gated private preview. So hopefully
[36:48] you found this session so exciting. You're going to go talk to your account reps and we'll be able to get you access in the coming weeks. But our next major milestone will be beta which is targeted right now for the midsummer time time
[37:01] frame. um at which point Genie sorry lakewatch will become available for all tier two and tier three data bricks customers and then we as you saw we uh huge announcements this week we are
[37:14] really doubling down on um Lakewatch watch and the the open agentic sim um and so we'll be targeting GA towards the end of our fiscal year um with that though we wanted to see give you the information on how to get started you
[37:27] can scan the QR code here um and it will bring you to more materials specifically about Lakewatch. And if you're interested in getting access to the private preview, follow up with your account reps and then they'll come bother Molly and I and we'll flip the
[37:40] flags on our side and and uh hopefully get you all stood up so you can start using Lakewatch to monitor your data bricks environment and other environments. So cool.
[37:52] All right.

Learn more about the Databricks Data and AI platform.

The information provided herein is for general informational purposes only and may not reflect the most current product capabilities or configurations.