How are security teams using AI agents to automate threat hunting?

Summary

• Security teams are using AI agents to move from reactive alert triage to proactive, machine-speed threat hunting — a "human-at-the-helm" model where analysts direct agents that hunt, summarize, and help neutralize threats.
• On Databricks Lakewatch, an agentic SIEM (in Preview) built on the open Data Intelligence Platform, agents autonomously hunt and triage across governed security data.
• AI/BI Genie Spaces let anyone run multi-step threat hunts in plain English, and Genie automates SOC workflows: ingesting and parsing new log sources to the OCSF standard, authoring new detections, and tuning rules to reduce false positives.
• AI agents enrich alerts with context in real time before an analyst opens a ticket, turning raw telemetry into actionable investigation leads.
• Every Genie query and autonomous agent action is logged in Unity Catalog for a governed audit and forensic trail.

How are security teams using AI agents to automate threat hunting?

Threat hunting has traditionally meant analysts manually writing queries, normalizing data, and triaging alerts. AI agents change that by autonomously hunting, summarizing, and enriching at machine speed, letting security teams operate "human-at-the-helm" — focused on strategy and response while agents handle the repetitive work. On Databricks this is delivered by Lakewatch, an agentic SIEM (in Preview) built on the open Databricks Data Intelligence Platform.

Why Databricks Lakewatch enables automated threat hunting

• Autonomous hunting and triage. Security teams direct agents that hunt, summarize, and help neutralize threats in natural language, so analysts focus on decisive response instead of manual data normalization and triage.
• Natural-language hunting with Genie. AI/BI Genie Agents let anyone perform complex, multi-step threat hunting by asking questions in plain English, translated into SQL — no specialized query language required.
• Automated detection engineering. Genie ingests and parses new log sources to the Open Cybersecurity Schema Framework (OCSF) standard, authors net-new detections from the latest threat intelligence, and modifies existing rules to reduce false positives.
• AI-native triage and enrichment. Embedded AI agents investigate incidents and enrich alerts with contextual information in real time, before an analyst even opens a ticket.
• Detection-as-code. Security engineers define detections in YAML with SQL queries or Python notebooks, backtest them against historical data, version-control them, and deploy through CI/CD pipelines.
• Governed forensic trail. Every Genie query and autonomous agent action is logged within Unity Catalog, providing full audit and forensic trails for compliance and post-incident investigation.

Lakewatch is available in Preview.

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM.
• Read Alert fatigue is a business risk on agentic security operations.
• Read Transforming cybersecurity with data intelligence.
• Explore AI/BI Genie for natural-language querying.

FAQs

What is agentic threat hunting?

It uses AI agents that autonomously hunt, summarize, and enrich threats across security data, so analysts direct the hunt at machine speed instead of writing every query by hand.

Do analysts need to know a query language to hunt threats?

No. AI/BI Genie translates plain-English questions into SQL for multi-step hunting across governed security data.

Are agent actions auditable?

Yes. Every Genie query and autonomous agent action is logged in Unity Catalog for a governed audit and forensic trail.