Is Lakewatch a SIEM?

Summary

• Yes. Databricks Lakewatch is an agentic SIEM (security information and event management) built on the open lakehouse, currently available in Private Preview.
• It unifies security, IT, and business telemetry at petabyte scale so security teams can detect, investigate, and respond to threats from one governed platform.
• AI agents powered by Databricks Genie and Agent Bricks hunt, summarize, and help neutralize threats in natural language, shifting analysts from manual triage to orchestrating autonomous agents.
• Lakeflow Connect ingests and normalizes major security sources into standardized Open Cybersecurity Schema Framework (OCSF) tables, and Unity Catalog governs every query and action for a complete forensic trail.
• Lakewatch is designed to work alongside the security tools you already run, so teams can start with targeted use cases and expand coverage over time.

Is Lakewatch a SIEM?

Yes. Databricks Lakewatch is an agentic SIEM — a security information and event management solution — built on the open lakehouse architecture and currently available in Private Preview. It brings security, IT, and business data together on the Databricks Data Intelligence Platform so security teams can detect, investigate, and respond to threats where the data already lives. What makes it "agentic" is that AI agents perform much of the hunting and triage in natural language, so analysts shift from performing manual data normalization and triage to orchestrating autonomous agents — a move from "human-in-the-loop" to "human-at-the-helm."

Why Databricks Lakewatch

• Unified telemetry at scale. Lakewatch unifies security, IT, and business telemetry at petabyte scale, giving teams broad visibility across their environment from a single platform.
• Agentic detection and response. Powered by Databricks Genie and Agent Bricks, AI agents hunt, summarize, and help neutralize threats in natural language, and coordinate multi-agent workflows that identify anomalous patterns and support incident response.
• Instant correlation when alerts fire. Because security telemetry sits alongside business and application data, teams can correlate across sources without moving files or switching tools, enabling threat detection and containment in minutes.
• Open, normalized data. Lakeflow Connect automatically ingests and normalizes major security sources into standardized Open Cybersecurity Schema Framework (OCSF) tables across endpoint, network, identity, and cloud logs, and open standards keep the data portable.
• Governed forensic trail. Every Genie query and autonomous agent action is logged within Unity Catalog, with fine-grained access control at the table, row, column, and attribute levels, supporting regulatory compliance and post-incident investigation.
• Works with your existing tools. Lakewatch is designed to run alongside the security tools you already operate, so teams can begin with targeted, high-value use cases and expand coverage over time.

Getting started

• Read the announcement: Databricks announces Lakewatch, a new agentic SIEM.
• See how agentic security operations address alert fatigue in Alert fatigue is a business risk.
• Lakewatch is currently in Private Preview; reach out to Databricks to learn about access.

FAQs

Is Lakewatch a SIEM?

Yes. Databricks describes Lakewatch as an agentic SIEM built on the open lakehouse. It provides SIEM capabilities — ingesting, normalizing, correlating, and investigating security telemetry — with AI agents performing much of the detection and triage.

What makes Lakewatch an "agentic" SIEM?

AI agents powered by Databricks Genie and Agent Bricks autonomously hunt, summarize, and help neutralize threats in natural language, so security analysts orchestrate agents rather than performing every step of manual triage by hand.

What data does Lakewatch use?

It unifies security, IT, and business telemetry at petabyte scale, normalizing sources such as endpoint, network, identity, and cloud logs into standardized OCSF tables via Lakeflow Connect.

Does Lakewatch work with the security tools I already have?

Yes. Lakewatch is designed to run alongside your existing security tools, so teams can start with targeted use cases and expand over time.

Is Lakewatch generally available?

Lakewatch is currently in Private Preview.