How do Lakeflow Connect, Unity Catalog, and Genie work together in Lakewatch?

Summary

• One governed security workflow. Databricks Lakewatch is an agentic SIEM built on an open security lakehouse. Lakeflow Connect ingests security telemetry, Unity Catalog governs and audits it, and Genie lets analysts investigate in natural language. See Databricks announces Lakewatch, a new agentic SIEM.
• Lakeflow Connect ingests telemetry. Managed connectors bring security, IT, and business telemetry into the lakehouse, normalizing sources into the open OCSF (Open Cybersecurity Schema Framework) standard, with source credentials stored securely in Unity Catalog connections.
• Unity Catalog governs and audits. Unity Catalog applies fine-grained permissions, end-to-end lineage, and a full audit trail to the security data, and every Genie query and autonomous agent action is logged for forensic review.
• Genie investigates in natural language. Security teams ask investigation questions in plain language and orchestrate autonomous agents to hunt, correlate, and summarize across petabyte-scale telemetry. See Genie and Lakewatch for SOC investigation.
• Currently in Private Preview. Lakewatch is in private preview and its capabilities are in active development and may change.

How do Lakeflow Connect, Unity Catalog, and Genie work together in Lakewatch?

Databricks Lakewatch is an agentic SIEM (security information and event management) built on an open security lakehouse on the Databricks Data Intelligence Platform. It brings security, IT, and business telemetry together at petabyte scale, then applies autonomous AI agents to detection, hunting, triage, and response. Three platform components make this work as one governed pipeline: Lakeflow Connect ingests the data, Unity Catalog governs and audits it, and Genie provides a natural-language interface for investigation. See Databricks announces Lakewatch, a new agentic SIEM.

Why Databricks Lakewatch brings these together

• Lakeflow Connect — ingest security telemetry. Lakeflow Connect uses managed connectors to bring security, IT, and business telemetry — including high-volume network and endpoint (EDR) streams and authentication logs — into the lakehouse. Credentials for source systems are stored securely in Unity Catalog connections, ingestion runs on managed pipelines, and disparate sources are normalized into the open OCSF (Open Cybersecurity Schema Framework) standard so detections can be built quickly on a common schema.
• Unity Catalog — govern and audit. Unity Catalog is the centralized governance layer for all ingested security data and for the agents that act on it. It provides fine-grained permissions so only authorized users and systems can read or write security data, end-to-end lineage from ingestion through downstream analytics, and secure credential storage that controls who can create and edit pipelines. Every Genie query and autonomous agent action is logged in Unity Catalog, providing an auditor-defensible trail for compliance and post-incident forensics.
• Genie — investigate in natural language. Genie is the conversational, agentic interface in Lakewatch. Instead of writing complex queries or learning a proprietary search language, security analysts ask investigation questions in plain language and orchestrate autonomous agents that hunt, correlate, and summarize across petabyte-scale data. An analyst can, for example, ask for all authentication events for a given user over the past week, the systems they accessed, related sensitive-data access events, and associated EDR alerts — and receive the synthesized answer in a single conversational response. See Genie and Lakewatch for SOC investigation.
• How they fit together. Telemetry ingested by Lakeflow Connect lands in Unity Catalog-governed Delta tables in open formats such as OCSF. Because the data is governed and open the moment it lands, it is immediately actionable for Genie and the autonomous agents — which correlate security events with enterprise context such as asset inventories and business data, and surface enriched incident summaries rather than raw alert floods. The result is one platform where ingestion, governance, and AI-driven investigation share the same trusted data.

Lakewatch is currently in private preview, and the capabilities described here are in active development and may change.

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM for an overview of the open security lakehouse.
• See how natural-language investigation works in Genie and Lakewatch for SOC investigation.

FAQs

What does Lakeflow Connect do in Lakewatch?

Lakeflow Connect ingests security, IT, and business telemetry into the lakehouse using managed connectors, stores source credentials in Unity Catalog connections, and normalizes sources into the open OCSF schema so detections can be built on a common format.

How does Unity Catalog govern security data in Lakewatch?

Unity Catalog applies fine-grained permissions, end-to-end lineage, and secure credential storage to the security data, and it logs every Genie query and autonomous agent action to provide an audit trail for compliance and post-incident investigation.

What does Genie enable in Lakewatch?

Genie lets security analysts ask investigation questions in natural language and orchestrate autonomous agents that hunt, correlate, and summarize across petabyte-scale telemetry, returning synthesized answers instead of requiring manual query writing.

Is Lakewatch generally available?

Lakewatch is currently in private preview, and its capabilities are in active development and may change.