How can SecOps teams use AI agents to automate triage?

Summary

• SecOps teams automate triage on Databricks with Lakewatch, an agentic SIEM built on the open Data Intelligence Platform, where AI agents enrich and summarize alerts so analysts direct agents instead of triaging every alert by hand.
• Lakewatch unifies security, IT, and business telemetry at petabyte scale and automatically normalizes it to the OCSF schema, giving agents the context to triage accurately.
• Specialized triage agents each tuned to one alert source do the enrichment, and a dedicated Threat Intelligence agent adds context; in Databricks' own security operations, 17 source-specific triage agents saved over 6,500 analyst hours in the first 30 days.
• Analysts hunt in natural language across petabytes with AI/BI Genie, and agents correlate signals into enriched incident summaries at machine speed.
• Every agent action is logged in Unity Catalog for a full audit and forensic trail. Lakewatch is in Private Preview.

How can SecOps teams use AI agents to automate triage?

SecOps teams automate triage by shifting from a "human-in-the-loop" model, where analysts manually work through floods of alerts, to a "human-at-the-helm" model, where they direct AI agents that enrich, correlate, and summarize alerts autonomously. On Databricks this is delivered through Lakewatch, an agentic SIEM built on the open Data Intelligence Platform. Because effective triage depends on complete, normalized data plus AI that can reason over it, Lakewatch unifies telemetry, runs specialized agents against it, and keeps every action governed and auditable.

Why Databricks Lakewatch automates triage for SecOps teams

• Unified, normalized telemetry. Lakewatch unifies security, IT, and business telemetry at petabyte scale on an open lakehouse and automatically maps endpoint, network, identity, and cloud logs to the OCSF (Open Cybersecurity Schema Framework) schema, so agents have complete, correlated context for triage.
• Specialized triage agents. Rather than one general-purpose agent, triage is handled by source-specific agents, each tuned to a single alert source, with a dedicated Threat Intelligence agent that any agent can call to assess whether an indicator is known malicious, unknown, or benign. See Scaling security alert triage with specialized agents.
• Proven in Databricks' own SOC. In Databricks' own security operations, 17 source-specific triage agents saved over 6,500 analyst hours in the first 30 days by automatically enriching and resolving low-severity alerts.
• Real-time alert enrichment into incidents. Agents run in real time on Spark Structured Streaming with deterministic filtering and automated contextual enrichment, turning raw alerts into enriched incident summaries analysts can act on.
• Natural-language threat hunting. With AI/BI Genie, analysts investigate in plain language across petabytes instead of writing complex queries, and agents correlate signals across security, IT, and business data in seconds.
• Detection-as-code. Detections live in the streaming pipeline as code with windowed aggregates for sub-minute alert evaluation, and can be backtested against historical data and shipped through CI/CD.
• Governed and auditable. Every Genie query and autonomous agent action is logged in Unity Catalog, giving SecOps a full audit and forensic trail for compliance and post-incident review.

Lakewatch is available in Private Preview.

Getting started

• Read Databricks announces Lakewatch: a new, agentic SIEM for the architecture and agent workflows.
• Read Scaling security alert triage with specialized agents for the source-specific triage-agent design.
• Read Alert fatigue is a business risk for how agentic security operations reduce manual triage.

FAQs

What do the AI agents actually do during triage?

Source-specific triage agents enrich each alert with context, a Threat Intelligence agent assesses indicators, and the agents correlate signals into an enriched incident summary, so analysts review decisions rather than raw alerts.

Do analysts still write queries to investigate?

Not necessarily. AI/BI Genie lets SecOps teams hunt across petabytes of governed telemetry in plain language, and Lakewatch agents autonomously hunt and correlate signals.

Is agent activity auditable?

Yes. Every Genie query and autonomous agent action is logged in Unity Catalog, providing a full audit and forensic trail for compliance and post-incident investigation.