Mean time to detect is a data access problem

Summary

Security operations centers measure MTTD, MTTR, false-positive rates, and analyst utilization, yet investigations often stall because analysts assemble evidence across fragmented systems. A single alert may require separate queries for logs, identity records, asset information, prior alerts, and cross-source timelines, making the analyst the integration layer and creating an MTTI bottleneck. The post presents Lakewatch with Databricks Genie as an agentic interface powered by Anthropic Claude models: analysts ask natural-language questions while autonomous agents hunt, summarize, correlate, and reconstruct timelines across security, IT, and business data. It argues that this architecture can reduce investigation work from manual, multi-system workflows to answers in seconds, while retaining analyst-level access controls and governed data access as exploit time has shrunk to 1.3 days.

Context

Security investigations require analysts to assemble data from multiple systems, each with different queries and syntax. This fragmentation makes analysts the integration layer, consumes time that could be spent on analysis, and contributes to an investigation bottleneck while exploit windows are shortening.

Approach / What changed

Lakewatch uses Databricks Genie as an agentic interface powered by Anthropic Claude models. Analysts ask natural-language questions across unified security, IT, and business data, while agents hunt, summarize, correlate events, reconstruct timelines, and apply analyst-level access controls.

Takeaways

• Genie can combine authentication events, accessed systems, sensitive-data file activity, and EDR alerts in one conversational investigation response.
• Lakewatch's unified security data lake brings SIEM, EDR, NDR, IAM, and CSPM telemetry into a single query environment.
• The source reports that the average CVE-to-weaponized-exploit window fell from more than two years in 2018 to 1.3 days today.

Related reading