Databricks Lakewatch: The First True Agentic SIEM for the Lakehouse

The SIEM (Security Information and Event Management) market has been ripe for disruption for a decade, and today Databricks delivered the knockout blow. Unveiled at their Spring Security Summit, Databricks Lakewatch is being billed as the world's first "Agentic SIEM." Built natively on the Delta Lake architecture and powered by Anthropic's Claude 4.6 reasoning engine, Lakewatch moves beyond simple alerting into autonomous threat hunting and investigation.

Moving Security to the Data, Not the Other Way Around

Traditional SIEMs like Splunk or Sentinel require data to be ingested into proprietary silos, leading to massive egress costs and "data lag." Lakewatch flips the script by running security logic directly on the Lakehouse. This means security teams can analyze petabytes of historical logs without moving a single byte. By leveraging Unity Catalog for unified governance, Lakewatch can correlate network logs, cloud trail events, and application telemetry in a single, high-performance environment.

The "Agentic" part comes from the deep integration with Anthropic Claude. Unlike traditional AI assistants that simply summarize alerts, Lakewatch's agents can independently formulate a hypothesis, write SQL queries to test it, analyze the results, and then pivot to a different data source if the hypothesis is disproven. This mimics the workflow of a senior SOC (Security Operations Center) analyst at machine speed.

Autonomous Investigation Workflows

When Lakewatch detects a potential anomaly—such as a suspicious IAM role assumption followed by a large data transfer—it doesn't just fire an alert. It spawns a dedicated Investigation Agent. This agent immediately gathers context: Who owns the IAM role? What IP addresses were involved? Has this pattern occurred elsewhere in the industry? The agent then presents a complete, cited report to the human operator, often before the operator has even seen the initial alert.

Technically, Lakewatch utilizes Databricks' Serverless Compute to scale investigation resources on-demand. This is paired with a new feature called "Log-to-Logic" (L2L), which translates unstructured logs into a semantic graph that Claude can reason over. This solves the "dirty data" problem that has historically made AI-driven security difficult to implement at scale.

Impact on the Security Operations Center

The goal of Lakewatch is not to replace security analysts, but to solve the "Alert Fatigue" crisis. By automating the first 30–60 minutes of every investigation, Lakewatch allows human analysts to focus on high-level strategy and complex response. Databricks claims that early beta testers saw a 70% reduction in Mean Time to Resolution (MTTR) for critical incidents.

The pricing model is also disruptive. Instead of charging per GB of ingestion, Databricks is charging based on Compute usage and Agent outcomes. This aligns the cost of the tool with the value it provides, a significant shift from the legacy "tax on data" model. Lakewatch is available in public preview starting today for all Databricks SQL customers.