Cybersecurity is now a data problem as much as it is a security problem. Cloud services, applications, identities, endpoints, and networks generate a massive amount of security telemetry, which has to be gathered, correlated, and examined so teams can detect threats. As organizations go cloud native and bring more AI workloads into the picture, the traditional SIEM approach tends to fall short. Many traditional SIEM solutions struggle with fragmented data, increasing ingestion costs, and not enough visibility across distributed environments.

To help address those challenges, Databricks introduced Lakewatch.

An Open, Agentic SIEM Architecture

Availability Note: As of October 2026, Databricks Lakewatch continues to be in Private Preview and can be enabled on the workspace upon request to your Databricks Account team. 

Databricks Lakewatch is a next-generation Security Information and Event Management (SIEM) platform designed for modern enterprise environments. Databricks describes Lakewatch as an open, agentic SIEM because it combines open data technologies with AI-powered security operations. It helps organizations centralize security operations by bringing together telemetry from diverse sources, enabling security teams to monitor, investigate, and respond to threats from a single platform. Built on the Databricks Data Intelligence Platform, Lakewatch combines scalable data processing with AI-driven capabilities to support faster investigations and more informed security decisions. 

Open by Design

Lakewatch is based on open standards and the use of interoperable technologies rather than on proprietary security storage. By supporting technologies such as the Open Cybersecurity Schema Framework (OCSF), Delta Lake, and Apache Iceberg, it enables organizations to ingest, store, and analyze security telemetry in open formats. This facilitates easier integration, aids long-term data retention, and provides the flexibility needed to develop and evolve security architectures over time. Instead of copying data sets across various platforms, Lakewatch allows analysts to carry out security operations directly on the lakehouse so that they can correlate security, operational, and business data. The unified method offers richer investigation context, wider security insights, and less operational complexity.

Agentic by DatabricksIQ

Lakewatch includes AI-powered security agents; they help analysts through the whole security lifecycle. These agents aid in correlating alerts, spotting suspicious behavior, prioritizing investigations, supporting threat hunting, and also speeding up incident response.  

Instead of fully replacing security analysts, the AI augments their efforts by taking care of the repetitive parts of investigative work, so teams can keep their attention on higher-value analysis and on the decision-making side.

How Lakewatch Works: End-to-End Flow

Lakewatch brings security telemetry through a unified workflow, from ingestion and normalization to detection, investigation and response:

1. Ingest: Security telemetry from cloud, identity, endpoint, network and other sources is ingested and normalized using capabilities such as Lakeflow Connect.

2. Normalize and Store: Telemetry is normalized to the Open Cybersecurity Schema Framework (OCSF) and stored in open formats such as Delta Lake or Apache Iceberg, with Unity Catalog providing centralized governance.

3. Detect and Analyze: Detection as Code, machine learning and large-scale analytics are used to identify suspicious activity, support threat detection and enable threat hunting across security data.

4. Investigate with AI: Genie enables natural-language security investigations, while Lakewatch's agentic capabilities help automate detection and investigation workflows. Security data can also be analyzed alongside IT and business data to provide broader investigation context.

5. Triage and Respond: AI-powered security agents assist with tasks such as alert triage, investigation and threat response, helping security teams act faster.

Core Platform Capabilities

Beyond its open architecture and AI-powered investigations, Lakewatch provides several capabilities that help organizations modernize security operations:

• Lakeflow Connect: Automates high-volume ingestion of security telemetry into the Open Security Lakehouse.
• Genie Code: Assists analysts by authoring detection rules, optimizing existing detections and translates natural language requests into SQL for investigations.
• Genie Agents: Enables analysts to perform multi-step threat hunting and investigations using  natural language without writing complex queries.
• Detection as Code: Defines detection logic using YAML, SQL queries or Python notebooks with support for historical backtesting and CI/CD deployment.
• Custom ML Detections: Uses MLflow, Feature Store and Model Serving to build and deploy machine learning models for anomaly detection, behavioral analytics and entity risk scoring.
• AI/BI Dashboards: Provides executive, operational and compliance dashboards with AI-enhanced visualizations for security monitoring, analysis and reporting.

Key benefits:

• Unified Security Telemetry: Analyze cloud, endpoint, identity, network, application and business telemetry in a single governed platform.
• AI-Assisted Investigations: Accelerate threat detection and investigations with AI-powered event correlation and threat analysis.
• Open Architecture: Less vendor lock-in with open standards such as OCSF, Delta Lake and Apache Iceberg.
• Centralized Governance: Leverage Unity Catalog for consistent access control, auditing and data lineage.
• Security Analytics at Scale: Process enterprise-scale security telemetry on the Databricks Data Intelligence Platform.
• Richer Investigations: Security, Operational, and Business Data Correlation to Improve Investigation Outcomes

Lakewatch simplifies security operations on a trusted data platform so security teams can improve security visibility, accelerate response and simplify operations.

Potential Use Cases

Lakewatch enables organizations to modernize security operations by combining unified telemetry, AI-assisted investigation workflows and centralized governance capabilities in the Databricks Lakehouse ecosystem. The enterprise’s potential use cases are:

• Real-Time Fraud Detection: Lakewatch SIEM can be used to correlate authentication events, transaction records and user activity data to spot suspicious behavior and speed up fraud investigations.
• Cloud Security Monitoring: Security across hybrid and multi-cloud setups could be monitored by analyzing telemetry from cloud infrastructure, SaaS apps, Kubernetes clusters and various other cloud native services
• Identity Threat Detection: Identity, endpoints, and network telemetry can be pulled together to detect compromised accounts, actions on privilege abuse, suspicious authentication attempts and user account behavior.
• Compliance and Audit Support: Centralize security telemetry and governance metadata inside an Open Security Lakehouse architecture so teams can back audit reporting, regulatory analysis and long-term data retention.  
• Enterprise Threat Hunting: Use AI-assisted analytics and investigation workflows to correlate security, operational and business data. Helping analysts proactively identify emerging attack patterns and high-risk behaviors.

Cost and Economic Considerations

Traditional SIEM platforms often charge based on data ingestion, making large-scale security telemetry retention expensive. Lakewatch takes a different approach by decoupling storage from compute, allowing organizations to retain security data in cloud storage and use compute when analytics are required. Databricks claims this model can provide up to 80% lower total cost of ownership (TCO) compared with traditional SIEM approaches. 

However, the cost advantage depends on the workload. With costs shifting from data ingestion toward compute and data processing, actual savings can vary depending on factors such as data volume, retention requirements and analytics usage. 

Conclusion

Databricks Lakewatch marks a move towards open, AI-powered security operations by integrating scalable data management, unified governance, and intelligent automation on one platform. It allows organisations to analyse their security data in conjunction with operational and business context, which in turn helps security teams to make quicker and more informed decisions and at the same time establishes a flexible base for future security innovation.

How v4c.ai Can Help

We at v4c.ai specialize in designing secure Open Security Lakehouse architectures,  implementing centralized governance via Unity Catalog. Our organization ensures seamless integration of diverse security data sources, while tuning performance and cost and enabling AI-assisted security operations smoothly.

With over 750 Databricks certifications and a team of 550+ skilled practitioners, we’ve got a solid track record delivering enterprise solutions for more than 200 clients across Financial Services, Retail Manufacturing, and Healthcare. We help our partners modernize their security operations with speed and precision using Databricks best practices.

References:

• Databricks Announces Lakewatch: New Open, Agentic SIEM: Official announcement introducing Databricks Lakewatch and the Open Agentic SIEM architecture.
• Introducing Lakewatch – Data + AI Summit Session – Official Databricks session covering Lakewatch architecture, AI-powered investigations, Open Security Lakehouse, and roadmap.
• Databricks Documentation – Official documentation for the Databricks Data Intelligence Platform.
• Databricks Lakewatch Product Demonstration (YouTube) – Official product demonstration showcasing LakeWatch capabilities and workflows.