---
title: "Scaling Security Alert Triage With Specialized Agents on Databricks"
description: "Databricks describes a security-alert triage system designed to review low-severity alerts that historically received less attention because of their volume and low fidelity. An initial single-agent prompt escalated 50% of alerts, so the team built a fleet of 17 source-specific agents plus a Threat Intelligence agent, using Structured Streaming to ingest alerts, enrich evidence, and route each alert. The pipeline combines deterministic benign-signal filtering, historical and behavioral context, specialized prompt functions, optional tools, structured dispositions, and cost controls before sending escalations to human analysts. Those analysts provide ground truth through MLflow traces and labels, supporting ongoing evaluation across escalate, monitor, and close decisions. After triaging more than 18,000 alerts, the system reached a 3.2% escalation rate, a 10.5-second median triage time, and more than 6,500 analyst hours saved in 30 days; escalated low-severity alerts were roughly 10 times more likely to be true positives than HIGH and MEDIUM alerts."
---

# Scaling Security Alert Triage With Specialized Agents on Databricks

[Databricks](https://yomu.fyi/company/databricks) · Leanne Shapton, Connor Hanify, Sam Pezzino · Jul 6, 2026

**Type:** Problem & solution

## Summary

Databricks describes a security-alert triage system designed to review low-severity alerts that historically received less attention because of their volume and low fidelity. An initial single-agent prompt escalated 50% of alerts, so the team built a fleet of 17 source-specific agents plus a Threat Intelligence agent, using Structured Streaming to ingest alerts, enrich evidence, and route each alert. The pipeline combines deterministic benign-signal filtering, historical and behavioral context, specialized prompt functions, optional tools, structured dispositions, and cost controls before sending escalations to human analysts. Those analysts provide ground truth through MLflow traces and labels, supporting ongoing evaluation across escalate, monitor, and close decisions. After triaging more than 18,000 alerts, the system reached a 3.2% escalation rate, a 10.5-second median triage time, and more than 6,500 analyst hours saved in 30 days; escalated low-severity alerts were roughly 10 times more likely to be true positives than HIGH and MEDIUM alerts.

## Context

The security lakehouse receives petabytes of logs and produces thousands of daily alerts. Low-severity alerts historically had low fidelity and were prioritized behind HIGH and MEDIUM alerts, creating a trade-off between increasing analyst headcount, raising detection thresholds, and accepting blind spots.

## Approach / What changed

The team replaced a single-agent triage design with 17 source-specific agents and a shared Threat Intelligence agent. The pipeline uses Structured Streaming, deterministic filtering, contextual enrichment, specialized prompt functions, optional retrieval tools, shared utilities, structured dispositions, MLflow tracing, analyst labels, and multiple cost controls.

## Takeaways

- Deterministic filters suppress known-benign signals before any LLM call and handle 30–95% of alert volume depending on the detection source.
- The agents retrieve specific security artifacts from authoritative sources instead of relying on LLM recall, because hashes, random subdomains, and generated file names are difficult for models to interpret accurately.
- Each alert includes the affected user's last six months of alert history, allowing agents to escalate repeated suspicious signals that standalone deterministic rules may not correlate.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [AI Security](https://yomu.fyi/topic/ai-security), [Databricks](https://yomu.fyi/topic/databricks), [Streaming](https://yomu.fyi/topic/streaming)

- Source: [Databricks](https://www.databricks.com/blog/scaling-security-alert-triage-specialized-agents-databricks)
- Source URL: https://www.databricks.com/blog/scaling-security-alert-triage-specialized-agents-databricks
- Ingested by Yomu: 2026-08-30T16:59:17.665Z

[Read original post](https://www.databricks.com/blog/scaling-security-alert-triage-specialized-agents-databricks)