Alert fatigue is a business risk

Summary

Enterprise security operations centers may receive tens of thousands of alerts daily, making prioritization necessary and leaving lower-priority signals uninvestigated. Alert fatigue is presented as a data architecture problem: fragmented endpoint, network, identity, and cloud telemetry, combined with proprietary SIEM collection-and-discard practices, limits correlation and overwhelms analysts. Lakewatch proposes an open lakehouse foundation that unifies security, IT, and business telemetry, applies automated OCSF normalization, and uses Agent Bricks for data wrangling and alert triage. Databricks Genie is positioned as a natural-language AI security agent whose autonomous agents can hunt, summarize, and neutralize threats, while Unity Catalog logs queries and actions for audit and forensic purposes. Lakewatch is currently available in Private Preview.

Takeaways

1. 1

   Automated OCSF mapping normalizes endpoint, network, identity, and cloud logs into a common schema for correlation.

2. 2

   The proposed “human-at-the-helm” model has analysts orchestrating agents that autonomously hunt, summarize, and neutralize threats at machine speed.

3. 3

   Unity Catalog logs every Genie query and autonomous action, creating an audit and forensic trail for compliance and post-incident investigation.