---
title: "Databricks Announces Lakewatch: New, Agentic SIEM"
description: "Databricks announces Lakewatch, an agentic SIEM intended to help organizations defend against increasingly sophisticated, AI-driven attackers. Launching in Private Preview, it unifies security, IT, and business data in a governed lakehouse built on Unity Catalog, while supporting open OCSF formats and storage in customer-controlled cloud object stores. Lakeflow Connect ingests and normalizes major security sources, and Detection-as-Code lets teams define YAML rules with SQL queries or Python notebooks, backtest them against historical data, and deploy through CI/CD. Genie Code and Genie Spaces provide AI-assisted ingestion, detection authoring, rule refinement, investigation, and natural-language threat hunting, while custom models can support anomaly detection, behavioral analytics, and entity risk scoring. The announcement also introduces an Open Security Lakehouse Ecosystem and acquisitions of Antimatter and SiftD.ai; Lakewatch is available in Private Preview, with Adobe and Dropbox among the named customers."
---

# Databricks Announces Lakewatch: New, Agentic SIEM

[Databricks](https://yomu.fyi/company/databricks) · Reynold Xin, Andrew Krioukov, Molly Limaye, Taylor Kain, Keegan Dubbs · Sep 18, 2026

**Type:** Announcement

## Summary

Databricks announces Lakewatch, an agentic SIEM intended to help organizations defend against increasingly sophisticated, AI-driven attackers. Launching in Private Preview, it unifies security, IT, and business data in a governed lakehouse built on Unity Catalog, while supporting open OCSF formats and storage in customer-controlled cloud object stores. Lakeflow Connect ingests and normalizes major security sources, and Detection-as-Code lets teams define YAML rules with SQL queries or Python notebooks, backtest them against historical data, and deploy through CI/CD. Genie Code and Genie Spaces provide AI-assisted ingestion, detection authoring, rule refinement, investigation, and natural-language threat hunting, while custom models can support anomaly detection, behavioral analytics, and entity risk scoring. The announcement also introduces an Open Security Lakehouse Ecosystem and acquisitions of Antimatter and SiftD.ai; Lakewatch is available in Private Preview, with Adobe and Dropbox among the named customers.

## Context

The announcement frames traditional SIEM architecture as poorly matched to AI-driven attacks operating at machine speed. It identifies coupled storage and compute, limited retention, costly duplication, and inability to process multimodal data as constraints that leave defenders with only a fraction of their available security context.

## Approach / What changed

Lakewatch runs security operations directly on the lakehouse, combining governed access through Unity Catalog, OCSF-based open formats, automated ingestion with Lakeflow Connect, and customer-controlled storage in Delta Lake or Apache Iceberg. Genie tools assist with ingestion, detections, and investigations; Detection-as-Code supports YAML, SQL, Python notebooks, historical backtesting, and CI/CD deployment. Serverless compute separates query cost from retained storage.

## Takeaways

- Lakewatch stores security telemetry alongside business data under Unity Catalog, enabling correlation across HR, collaboration, application, and transaction data without duplicating or moving files.
- Detection-as-Code supports YAML rules with SQL queries or Python notebooks, historical backtesting, and deployment through CI/CD pipelines.
- By decoupling storage from compute, Lakewatch is designed to retain full-fidelity, potentially multimodal telemetry in customer-controlled cloud storage while charging for compute when queries run.

## FAQ

### How does Lakewatch reduce the cost of retaining security data?

It separates storage from compute, allowing organizations to retain petabytes of full-fidelity telemetry in cloud object storage they control. The announcement says customers pay for compute rather than per-byte license fees and can run serverless analytics when needed.

### What can Genie automate for security teams?

Genie Code can ingest and parse new log sources into OCSF, author detections, modify rules to reduce false positives, and translate natural-language questions into SQL. Genie Spaces provides a natural-language interface for complex, multi-step threat hunting.

### How are detections tested and deployed?

Detection-as-Code defines rules in YAML using SQL queries or Python notebooks. Teams can backtest those rules against historical data and deploy them through CI/CD pipelines.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [Lakehouse](https://yomu.fyi/topic/lakehouse), [Security](https://yomu.fyi/topic/security)

- Source: [Databricks](https://www.databricks.com/blog/databricks-announces-lakewatch-new-agentic-siem)
- Source URL: https://www.databricks.com/blog/databricks-announces-lakewatch-new-agentic-siem
- Ingested by Yomu: 2026-09-17T14:13:04.027Z

[Read original post](https://www.databricks.com/blog/databricks-announces-lakewatch-new-agentic-siem)