Can I use databricks lakewatch with my current SIEM?

Summary

• Yes. Databricks Lakewatch is designed to work alongside your existing SIEM, so you can adopt it incrementally without disrupting current detections.
• A common starting point is to offload high-volume sources — such as network, endpoint, and authentication logs — to Lakewatch for retention and AI-powered analytics while your core detections keep running where they are.
• Lakewatch is built on open standards (OCSF, Delta, Parquet, SQL) in your own cloud storage, so your security data stays portable and accessible across tools.
• Lakeflow Connect ingests and normalizes major security sources into standardized OCSF tables, reducing engineering lift.
• Everything is governed and audited in Unity Catalog. Lakewatch is available in Private Preview.

Can I use Databricks Lakewatch with my current SIEM?

Yes. Lakewatch is designed to work alongside your existing security tooling, so you can start with narrow, high-value use cases and expand at your own pace. Because it stores telemetry in open formats in your own cloud storage, adopting Lakewatch does not require moving off the tools your team already relies on.

How Lakewatch works alongside your existing SIEM

Databricks Lakewatch is an agentic SIEM built on the open Databricks Data Intelligence Platform.

• Coexistence, adopted incrementally. Run Lakewatch in parallel with your current SIEM. A common pattern is to offload high-volume sources — network, endpoint, and authentication logs — to Lakewatch for petabyte-scale retention and AI-powered analytics, while your existing detections keep running where they are.
• Open standards, portable data. Lakewatch is built on OCSF and stores security data in open formats (Delta or Apache Iceberg, Parquet, SQL) in your own cloud storage, so telemetry is never locked into a proprietary format and stays accessible across your tooling.
• Automated ingestion and normalization. Lakeflow Connect ingests major cloud, identity, network, and endpoint sources and normalizes them into standardized OCSF tables using pre-built connectors and parsers, reducing engineering lift.
• Unified context. Correlate security events with enterprise context — such as asset inventories and business data — in one governed environment.
• Petabyte-scale retention. Retain months or years of high-fidelity telemetry so analysts and AI agents have the historical depth to investigate multi-stage attacks.
• Governed and audited. Unity Catalog provides fine-grained access control and logs every query and autonomous action for a full audit and forensic trail.

Lakewatch is available in Private Preview.

Getting started

• Read Databricks Announces Lakewatch: a new, agentic SIEM for the architecture and adoption model.
• Review Lakeflow Connect to see how security sources are ingested and normalized to OCSF.
• Read Alert fatigue is a business risk for how agentic security operations fit into a SOC.

FAQs

Do I have to move everything off my current SIEM to use Lakewatch?

No. Lakewatch is designed for coexistence. Many teams begin by offloading high-volume logs to Lakewatch for retention and analytics while keeping their existing detections in place, then expand over time.

How does my security data stay portable?

Lakewatch is built on the OCSF open schema and stores data in open formats in your own cloud storage, so your telemetry remains portable and accessible across your security and analytics tools.

How are logs ingested into Lakewatch?

Lakeflow Connect provides pre-built connectors that ingest major cloud, identity, network, and endpoint sources and normalize them into standardized OCSF tables.