---
title: "How iFood built its agentic security platform on ClickHouse Cloud"
description: "iFood’s security incident response team needed high-volume log ingestion, long-term retention, and rapid access to months of history, but its Databricks-based platform became costly to scale beyond 130 TB and imposed query timeouts. The team ran a production-data proof of concept and rebuilt its tooling around ClickHouse Cloud on AWS: logs land in S3 and flow through ClickPipes into ClickHouse, with Querybook preserving notebook-based investigations and ClickStack planned for operational metrics. With ClickHouse Cloud, iFood reports 9–16x faster queries, expected cost reductions of 40–50%, and data freshness improving from hourly batches to 2–10 minutes; alerts that previously ran hourly can now run about every 10 minutes. That foundation also supports agentic threat hunting: multiple sub-agents query more than 30 TB in parallel, reducing a hunt from about a week to roughly two hours, while Langfuse is used to inspect and tune agent analyses."
---

# How iFood built its agentic security platform on ClickHouse Cloud

[Clickhouse](https://yomu.fyi/company/clickhouse) · Aug 12, 2026

**Type:** Problem & solution

## Summary

iFood’s security incident response team needed high-volume log ingestion, long-term retention, and rapid access to months of history, but its Databricks-based platform became costly to scale beyond 130 TB and imposed query timeouts. The team ran a production-data proof of concept and rebuilt its tooling around ClickHouse Cloud on AWS: logs land in S3 and flow through ClickPipes into ClickHouse, with Querybook preserving notebook-based investigations and ClickStack planned for operational metrics. With ClickHouse Cloud, iFood reports 9–16x faster queries, expected cost reductions of 40–50%, and data freshness improving from hourly batches to 2–10 minutes; alerts that previously ran hourly can now run about every 10 minutes. That foundation also supports agentic threat hunting: multiple sub-agents query more than 30 TB in parallel, reducing a hunt from about a week to roughly two hours, while Langfuse is used to inspect and tune agent analyses.

## Context

iFood’s security team built its own platform on Databricks instead of buying a packaged SIEM, but security operations required large-scale log ingestion, long retention, and fast access to three to six months of history. As the platform grew beyond 130 TB, cost controls introduced query timeouts and limited the number of alerts the team could create, making detection development and incident response difficult.

## Approach / What changed

The team evaluated ClickHouse and Databricks with one month of production data, then rebuilt its security tooling around ClickHouse Cloud on AWS. Logs from infrastructure, file systems, Kubernetes workloads, and cloud consoles land in S3 and are ingested through ClickPipes. Querybook preserves notebook-based investigations, ClickStack is being adopted for operational metrics, and Langfuse supports analysis and tuning of AI agents used for threat hunting.

## Takeaways

- ClickPipes gives iFood end-to-end log freshness of 2–10 minutes from S3 ingestion; Kafka remains an option if sub-minute freshness is needed.
- iFood’s endpoint detection and response logs generate 1.6 TB of raw data per day, while the team targets six months to one year of retention and investigates a month or more of data per hunt.
- The planned migration of CDN and API logs from OpenSearch is intended to extend retention from seven days to six months at one-quarter of the cost.

**Tags:** [AWS](https://yomu.fyi/topic/aws), [Kubernetes](https://yomu.fyi/topic/kubernetes), [LLMs](https://yomu.fyi/topic/llm), [Observability](https://yomu.fyi/topic/observability), [Performance](https://yomu.fyi/topic/performance)

- Source: [Clickhouse](https://clickhouse.com/blog/ifood-agentic-security-platform)
- Source URL: https://clickhouse.com/blog/ifood-agentic-security-platform
- Ingested by Yomu: 2026-08-29T07:46:07.160Z

[Read original post](https://clickhouse.com/blog/ifood-agentic-security-platform)