How are security incidents detected, investigated, and contained?

Summary

• On the Databricks Data Intelligence Platform, security incidents are detected, investigated, and contained on one governed platform using unified audit data, fine-grained governance, and AI-assisted analysis.
• Detection: the system.access.audit system table is the system of record for all material events, and 40+ pre-built queries and alerts flag failed logins, unauthorized data access, privilege escalation, and destructive actions; Enhanced Security Monitoring adds host-level malware and behavior detection.
• Investigation: AI/BI Genie lets teams query audit data in plain English, a System Table Audit dashboard visualizes 90 days of activity, and Lakehouse Monitoring flags anomalies.
• Containment: Unity Catalog enforces table-, row-, and column-level access controls with full auditability, so responders can restrict access fast and prove who accessed what and when.
• Databricks Lakewatch, an agentic SIEM (in Preview), adds AI agents that correlate signals and enrich alerts to accelerate investigation.

How are security incidents detected, investigated, and contained?

Incident response spans three phases — detecting suspicious activity, investigating what happened, and containing the impact. Doing it well requires one governed copy of security-relevant telemetry, fast analytics over it, and access controls that can be changed and audited quickly. The Databricks Data Intelligence Platform provides this through system tables, Unity Catalog, and AI-assisted analysis.

Why Databricks supports detection, investigation, and containment

• Detection with system tables and audit logs. The system.access.audit system table is the system of record for all material events on the platform, and its audit logs support incident response, forensic analysis, and threat hunting. Over 40 pre-built queries and alerts detect repeated failed logins, IP access-list failures, unauthorized Unity Catalog access, high-volume read/write operations, privilege escalation, and destructive delete events.
• Host-level threat detection. Enhanced Security Monitoring adds agents that detect malware-infected files and behavior-based suspicious host activity.
• Natural-language investigation. AI/BI Genie translates plain-English questions into governed SQL, so analysts can hunt across audit data without a specialized query language. A System Table Audit dashboard visualizes 90 days of Unity Catalog and data-access activity alongside account and workspace changes such as admin privilege modifications and failed-login trends.
• Anomaly detection. Lakehouse Monitoring detects anomalies in log ingestion and shifts in data distributions.
• Containment through governance. Unity Catalog enforces fine-grained access control at the table, row, column, and attribute levels with full auditability, so responders can restrict data access during an incident and produce an auditable record of who accessed what and when.
• Cloud-provider integration. System-table audit logs can be complemented with cloud-provider logs to observe actions across the compute and data planes.
• Agentic SOC (Preview). Databricks Lakewatch, an agentic SIEM in Preview, adds AI agents that correlate signals and enrich alerts to accelerate investigation and response.

Getting started

• Read Improve lakehouse security monitoring using system tables in Unity Catalog.
• Explore the audit log system table reference.
• Explore Unity Catalog governance and access controls.
• Read Transforming cybersecurity with data intelligence.

FAQs

What is the system of record for security events on Databricks?

The system.access.audit system table records all material events and serves as the system of record for security monitoring, incident response, and forensic analysis.

Can analysts investigate incidents without knowing SQL?

Yes. AI/BI Genie translates natural-language questions into governed SQL over audit data.

How does Databricks help contain an incident?

Unity Catalog enforces fine-grained, fully auditable access controls, so responders can quickly restrict access and prove exactly who accessed what and when.