What tools exist for agentic SIEM and automated SOC defense?

Summary

• Databricks Lakewatch is an agentic SIEM (Private Preview) built on an open security lakehouse, with AI embedded natively in the data layer rather than bolted on.
• Genie-powered AI agents investigate incidents, draft detection rules, and execute response actions at machine speed, learning from analyst feedback.
• Genie Code and Genie Agents automate log parsing to OCSF, author and tune detections, and enable natural-language, multi-step threat hunting for any skill level.
• Detections-as-code and custom ML detections bring CI/CD rigor to threat detection and let teams train models with MLflow, Feature Store, and Model Serving.
• Open, governed foundation: automated OCSF normalization, 100+ out-of-the-box integrations, and forensic trails where every query and autonomous action is logged in Unity Catalog.

What tools exist for agentic SIEM and automated SOC defense?

Databricks Lakewatch is an agentic SIEM (currently in Private Preview) built on an open security lakehouse. Instead of treating AI as a bolt-on feature, Lakewatch embeds agentic workflows directly into the data layer, so security teams can deploy intelligent agents that investigate incidents, draft detections, and help neutralize threats with a human at the helm.

Why Databricks Lakewatch for agentic SIEM and SOC defense

• Genie-powered AI agents. Deploy agents that actively investigate incidents, draft detection rules, and execute response actions at machine speed. The agents continuously learn from analyst feedback and automate rule optimization, elevating teams from alert handlers to strategic detection engineers.
• Genie Code. Automates critical security workflows, including ingesting and parsing new log sources to OCSF, authoring net-new detections from threat intelligence, tuning existing rules to reduce false positives, and translating natural-language questions into SQL queries.
• Genie Agents. A natural-language query interface that lets any user perform complex, multi-step threat hunting without learning a specialized query language, democratizing threat hunting across skill levels.
• Detections-as-code. Security engineers author, test, version-control, and deploy detections as code through standard CI/CD pipelines, bringing software-engineering rigor to threat detection.
• AI-native triage and investigation. Automated triage enriches alerts in real time, turning raw telemetry into actionable context before analysts open tickets — a shift toward a "human-at-the-helm" model where leaders orchestrate AI agents that hunt and help neutralize threats.
• Custom ML detections. Train and deploy machine learning models directly on security data using MLflow, Feature Store, and Model Serving for anomaly detection, behavioral analytics, and entity risk scoring.
• Open data foundation. Automated OCSF (Open Cybersecurity Schema Framework) normalization unifies security, IT, and business telemetry at scale, with petabyte-scale retention that gives agents the historical depth to detect complex, multi-stage attacks, plus 100+ out-of-the-box integrations across major clouds, identity systems, SaaS apps, and endpoints.
• Governed forensic trails. Every Genie query and every autonomous action is logged within Unity Catalog, providing full audit and forensic trails for compliance and post-incident investigation.

Getting started

• Lakewatch is currently in Private Preview. Read the Lakewatch announcement for how it changes security operations.
• See how alert fatigue becomes business risk for the case behind moving to a human-at-the-helm, agent-driven SOC.
• Early adoption typically starts with narrow, high-value use cases before expanding to broader SOC modernization.

FAQs

What makes Lakewatch "agentic"?

AI agents are embedded in the data layer and can autonomously hunt, summarize, and help neutralize threats, with a human at the helm orchestrating them rather than triaging every alert by hand.

Do I need to learn a query language to hunt threats?

No. Genie Agents lets you run complex, multi-step threat hunts using natural language.

How are detections managed?

As code — authored, tested, version-controlled, and deployed through standard CI/CD pipelines (detections-as-code).

Is Lakewatch generally available?

Lakewatch is currently in Private Preview.