Databricks Announces Lakewatch: New Open, Agentic SIEM

Rishabh_Tiwari — Fri, 27 Mar 2026 15:30:35 GMT

Earlier this week, Databricks announced Lakewatch, a new open, agentic SIEM designed to help organizations defend against increasingly sophisticated, AI-driven attacks. Lakewatch is currently available in Private Preview.

Lakewatch unifies security, IT, and business data into a single, governed environment for AI detection and response. Built on open formats, it enables customers to ingest, retain, and analyze unprecedented volumes of multi-modal data while reducing costs and eliminating vendor lock-in.

Here’s what stands out:

Unifies security, IT, and business data into a single, governed environment
Enables customers to ingest, retain, and analyze unprecedented volumes of multi-modal data
Built on the Open Cybersecurity Schema Framework (OCSF) and supports Delta Lake and Apache Iceberg
Provides fine-grained access control at table, row, column, and attribute levels with full auditability
Decouples storage from compute, allowing customers to store data and only pay for compute when running analytics

Lakewatch also introduces agentic capabilities through Genie and Genie Spaces, helping automate tasks such as log ingestion, detection creation, rule tuning, and threat investigation.

By bringing the lakehouse architecture to security operations, Lakewatch enables teams to analyze security data alongside business data, retain full-fidelity telemetry, and respond to threats more effectively.

Read Full Announcement

topic Databricks Announces Lakewatch: New Open, Agentic SIEM in Announcements

Databricks Announces Lakewatch: New Open, Agentic SIEM