Lakewatch

What it does

Lakewatch is Databricks' agentic SIEM, built on its security lakehouse. It ingests security telemetry, IT logs, and business data into a Databricks workspace and automatically normalizes it to the Open Cybersecurity Schema Framework (OCSF), so identity, endpoint, and network signals can be correlated across sources. Outputs include searchable investigation data, detections managed as code, and triage or summaries produced by Agent Bricks agents.

Security teams can retain logs in cloud object storage rather than dropping data to control costs, and investigate with native search. Detection rules can be version-controlled and automatically tested and deployed in a DevOps-style workflow. Genie lets analysts ask natural-language questions across telemetry, while Unity Catalog provides access control, data lineage, and audit trails. Data can be brought in through Lakeflow Connect managed connectors, including databases, file sources, and streaming sources such as Apache Kafka.

Lakewatch suits security operations teams and detection engineers at large organizations, especially those handling very high log volumes. It requires an active Databricks workspace on AWS, Azure, or GCP and is not a standalone SIEM. Pricing is usage-based, so request a quote or consult the Databricks price list for current Lakewatch rates. Teams new to the lakehouse architecture should expect a platform adoption step.

What it can do

• Ingest and retain security telemetry from many sources on the Databricks lakehouse
• Automatically normalize log data to the OCSF schema for cross-source correlation
• Manage security detections as code with automated testing and deployment
• Ask natural-language questions across telemetry using Genie
• Build autonomous triage and investigation agents with Agent Bricks
• Govern security data with Unity Catalog for access control, lineage, and auditing

Works with

• Lakeflow Connect managed connectors for enterprise applications, databases, file sources, and streaming sources such as Apache Kafka

Example workflows

Triage a suspicious login across sources (illustrative)

Input: identity and endpoint logs ingested via Lakeflow Connect and normalized to OCSF. Steps: a Lakewatch agent built with Agent Bricks correlates the login with endpoint events and pivots across network signals. Output: a summarized investigation for an analyst to review.

Manage a detection rule as code (illustrative)

Input: a detection rule stored in version control. Steps: changes are tested automatically and deployed through a CI/CD-style pipeline on the lakehouse. Output: a version-controlled, verified detection running against unified telemetry.

Before you choose

• Lakewatch requires a Databricks workspace on AWS, Azure, or GCP; it is not a standalone SIEM product.
• Costs depend on compute and storage usage under Databricks usage-based pricing; request a quote or check the Databricks price list for current Lakewatch rates before budgeting.
• Confirm connector availability for your specific log sources with Databricks before committing.

Listed under

• Security

Get started

The Lakewatch page links to a free trial and sales contact; the general trial covers the Databricks platform.

1. Provision or select a Databricks workspace on AWS, Azure, or GCP.
2. Connect security log sources using Lakeflow Connect managed connectors or Structured Streaming.
3. Configure Unity Catalog governance for access control, lineage, and audit logging across security data.

Costs depend on the underlying Databricks services, compute, cloud and region. Use the product’s current SKU rates and calculator; general platform trial credits are temporary.

We couldn’t find published prices for Lakewatch. See their pricing page ↗

Sources for this overview

Product pages, documentation, and pricing checked 28 Oct 2026. Each source supports part of the overview; availability and prices can change.

• Databricks Lakewatch: the agentic SIEM for security teams ↗www.databricks.com
• Databricks Pricing: Flexible Plans for Data and AI Solutions | Databricks ↗www.databricks.com
• What is Lakeflow Connect? | Databricks on AWS ↗docs.databricks.com

Company website

databricks.com: product, pricing and policy pages

Web search

Confirms the official site

Social accounts

Accounts the company links, and its posts on X

Human review

Checked by a person

knowledge_base

Last checked 28 Oct 2026. Every field keeps its source and date; unknown means we couldn’t confirm it.