How can I use natural language to hunt for threats across endpoint and cloud logs?

Summary

• On Databricks you hunt threats in plain English with AI/BI Genie on a security lakehouse, and with Lakewatch — an agentic SIEM (in Preview) built on the open Data Intelligence Platform.
• Genie translates plain-English questions into SQL for multi-step investigations across endpoint, network, identity, and cloud logs — no specialized query language required.
• Automated OCSF normalization maps disparate endpoint and cloud logs into a common schema, so a single natural-language question can correlate across previously siloed sources.
• Lakewatch agents autonomously hunt, summarize, and help neutralize threats at machine speed, so analysts direct the hunt "human-at-the-helm" instead of writing every query by hand.
• Every Genie query and autonomous agent action is logged in Unity Catalog for a governed audit and forensic trail.

How can I use natural language to hunt for threats across endpoint and cloud logs?

Threat hunting has traditionally meant writing queries in a specialized language for each data source, then manually stitching endpoint, network, identity, and cloud logs together. Natural-language hunting removes that barrier: analysts ask questions in plain English and the platform translates them into queries across all their unified security data. On Databricks this is delivered by AI/BI Genie on a security lakehouse, and by Lakewatch, an agentic SIEM (in Preview) on the open Databricks Data Intelligence Platform.

Why Databricks Lakewatch enables natural-language threat hunting across endpoint and cloud logs

• Ask in plain English. AI/BI Genie lets any analyst run complex, multi-step threat hunts by asking questions in natural language, which Genie translates into SQL — for example, "show me all authentication events for a user in the past 7 days, the systems they accessed, any file-access events on sensitive data, and any related endpoint alerts," returned as a single conversational investigation.
• Unified endpoint and cloud telemetry. Lakewatch unifies all security, IT, and business telemetry — including endpoint, network, identity, and cloud logs — at petabyte scale on one open lakehouse, so a hunt is not limited to a single source.
• Automated OCSF normalization. Automated Open Cybersecurity Schema Framework (OCSF) mapping normalizes disparate endpoint and cloud logs into a common schema, so a single natural-language question can correlate across sources that used to be siloed.
• Agentic hunting and triage. Analysts can orchestrate AI agents that autonomously hunt, summarize, and help neutralize threats at machine speed, shifting the SOC from a "human-in-the-loop" model to a "human-at-the-helm" model where people direct the hunt and set strategy.
• Deep historical retention. A security lakehouse retains months or years of high-fidelity telemetry, giving hunters the historical depth to trace complex, multi-stage attacks that span endpoint and cloud activity.
• Governed forensic trail. Every Genie query and autonomous agent action is logged within Unity Catalog, providing a full audit and forensic trail for compliance and post-incident investigation.

Lakewatch is available in Preview.

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM for how natural-language hunting and agentic triage work.
• Read Alert fatigue is a business risk on shifting the SOC to a human-at-the-helm model.
• See Genie and Lakewatch for SOC investigation for an end-to-end natural-language investigation example.
• Explore AI/BI Genie for natural-language querying on governed data.

FAQs

Do I need to know a query language to hunt threats?

No. AI/BI Genie translates plain-English questions into SQL and supports complex, multi-step investigations, so hunting across endpoint and cloud logs is not limited to specialists.

Can one question correlate endpoint and cloud logs together?

Yes. Automated OCSF normalization maps endpoint, network, identity, and cloud logs into a common schema, so a single natural-language question can correlate across sources that were previously siloed.

Are natural-language hunts auditable?

Yes. Every Genie query and autonomous agent action is logged in Unity Catalog, providing a governed audit and forensic trail for compliance and post-incident investigation.