How can I use natural language to query and threat hunt across my security logs?

Summary

• On Databricks you query and hunt across security logs in plain English with AI/BI Genie on a security lakehouse, and with Lakewatch — an agentic SIEM (in Preview) on the open Data Intelligence Platform.
• Genie Agents let security teams query petabytes of governed security data using plain English instead of a specialized query language, and translate questions into SQL for complex, multi-step hunts.
• Because all security logs are unified and normalized to the OCSF standard, one natural-language question can span sources that were previously siloed.
• Lakewatch agents autonomously hunt, summarize, and help neutralize threats at machine speed, and Genie Code can even author new detections from your findings.
• Every Genie query and autonomous agent action is logged in Unity Catalog for a governed audit and forensic trail.

How can I use natural language to query and threat hunt across my security logs?

Querying security logs has traditionally required learning a specialized search or query language and knowing exactly which index or table holds each log source. Natural-language querying removes that barrier: analysts ask a question in plain English and the platform generates the query across all their governed security data. On Databricks this is delivered by AI/BI Genie on a security lakehouse, and by Lakewatch, an agentic SIEM (in Preview) on the open Databricks Data Intelligence Platform.

Why Databricks Lakewatch enables natural-language querying and threat hunting across security logs

• Query petabytes in plain English. AI/BI Genie Agents provide a natural-language interface that lets security teams query petabytes of data by asking questions in plain English instead of a specialized query language, democratizing threat hunting across skill levels.
• Multi-step, conversational hunts. Genie supports complex, multi-step investigations and translates each question into SQL, so an analyst can pivot from an alert to related authentication, access, and endpoint activity in a single conversational thread.
• All security logs, unified and normalized. Lakewatch unifies all security, IT, and business telemetry at petabyte scale and uses automated Open Cybersecurity Schema Framework (OCSF) mapping to normalize disparate log sources into a common schema, so one natural-language question can correlate across sources that were previously siloed.
• Agentic hunting and detection authoring. Analysts can orchestrate AI agents that autonomously hunt, summarize, and help neutralize threats at machine speed, and Genie Code translates natural-language questions into SQL, ingests and parses new log sources to OCSF, and authors net-new detections based on the latest threat intelligence.
• Deep historical retention. A security lakehouse retains months or years of high-fidelity telemetry, giving hunters the historical depth to trace complex, multi-stage attacks across their logs.
• Governed forensic trail. Every Genie query and autonomous agent action is logged within Unity Catalog, providing a full audit and forensic trail for compliance and post-incident investigation.

Lakewatch is available in Preview.

Getting started

• Read Databricks announces Lakewatch, a new agentic SIEM for how natural-language querying, agentic hunting, and detection authoring work.
• See Genie and Lakewatch for SOC investigation for an end-to-end natural-language investigation example.
• Read Alert fatigue is a business risk on shifting the SOC to a human-at-the-helm model.
• Explore AI/BI Genie for natural-language querying on governed data.

FAQs

Do I need a specialized query language to search my security logs?

No. AI/BI Genie Agents let you query petabytes of governed security data by asking in plain English, and Genie translates each question into SQL for complex, multi-step hunts.

Can one question span multiple log sources?

Yes. Lakewatch unifies your security logs and normalizes them to the OCSF standard, so a single natural-language question can correlate across sources that were previously siloed.

Can I turn a successful hunt into a detection?

Yes. Genie Code can author net-new detections based on threat intelligence and translate natural-language findings into SQL, so a hunt can become a durable, repeatable detection.

Are natural-language queries and hunts auditable?

Yes. Every Genie query and autonomous agent action is logged in Unity Catalog, providing a governed audit and forensic trail.