Alert fatigue is a business risk

Summary

Enterprise security operations centers may receive tens of thousands of alerts daily, making prioritization necessary and leaving lower-priority signals uninvestigated. Alert fatigue is presented as a data architecture problem: fragmented endpoint, network, identity, and cloud telemetry, combined with proprietary SIEM collection-and-discard practices, limits correlation and overwhelms analysts. Lakewatch proposes an open lakehouse foundation that unifies security, IT, and business telemetry, applies automated OCSF normalization, and uses Agent Bricks for data wrangling and alert triage. Databricks Genie is positioned as a natural-language AI security agent whose autonomous agents can hunt, summarize, and neutralize threats, while Unity Catalog logs queries and actions for audit and forensic purposes. Lakewatch is currently available in Private Preview.

Context

Enterprise SOCs face alert volumes that exceed what human analysts can meaningfully process. Fragmented telemetry across endpoint, network, identity, and cloud systems, along with proprietary SIEM costs and collection practices, makes correlation difficult and leaves signals below prioritization thresholds uninvestigated.

Approach / What changed

Lakewatch unifies security, IT, and business telemetry on an open lakehouse architecture, uses automated OCSF normalization and Agent Bricks for data wrangling and triage, and enables Databricks Genie to coordinate AI agents for natural-language threat hunting, summarization, and response. Unity Catalog records queries and autonomous actions for audit and forensic purposes.

Takeaways

• Automated OCSF mapping normalizes endpoint, network, identity, and cloud logs into a common schema for correlation.
• The proposed “human-at-the-helm” model has analysts orchestrating agents that autonomously hunt, summarize, and neutralize threats at machine speed.
• Unity Catalog logs every Genie query and autonomous action, creating an audit and forensic trail for compliance and post-incident investigation.

Related reading