Databricks Lakewatch: Agentic AI for Your SOC

Databricks Lakewatch brings agentic AI to the security operations center (SOC): it triages alerts, investigates threats, and reasons over governed data in Unity Catalog — cutting alert fatigue and speeding incident response. This walkthrough shows how Lakewatch agents work and where they fit a modern SOC. 00:00 Agents are a new threat vector for the SOC 01:20 What is Databricks Lakewatch (a SIEM on Databricks) 01:38 Ingesting security logs: cloud storage & Lakeflow Connect 02:40 Normalizing to OCSF with bronze/silver/gold 03:41 Declarative YAML transforms in source control 04:13 Detection-as-code: rules as YAML 04:46 Auto-creating security cases for SecOps 05:17 Custom detections with Python notebooks & ML 05:47 Genie-driven investigation 06:51 Quick start: your Databricks audit logs 07:11 Unity Catalog governance & access control 07:53 Splunk-style ad-hoc threat hunting 🔗 Let's Connect: • 🌐 Master Databricks at our official hub: https://nextgenlakehouse.com/ • 📩 Subscribe to our Substack for monthly recaps: https://nextgenlakehouse.com • 💼 Connect with Youssef:   / youssefmrini