Why Your SOC Needs Agentic AI (Databricks Lakewatch)

Traditional SIEMs rely on bolt-on AI features that can't access the full context of your data. Lakewatch brings embedded AI directly to where your security data lives. Genie automates critical workflows such as ingesting and parsing new log sources to OCSF, authoring net-new detections based on the latest threat intelligence, modifying existing rules to reduce false positives, and translating natural language questions into SQL queries. Genie Spaces lets security teams query petabytes of data using plain English instead of specialized query languages, democratizing threat hunting across skill levels. 00:00 Agents are a new threat vector for the SOC 01:20 What is Databricks Lakewatch (a SIEM on Databricks) 01:38 Ingesting security logs: cloud storage & Lakeflow Connect 02:40 Normalizing to OCSF with bronze/silver/gold 03:41 Declarative YAML transforms in source control 04:13 Detection-as-code: rules as YAML 04:46 Auto-creating security cases for SecOps 05:17 Custom detections with Python notebooks & ML 05:47 Genie-driven investigation 06:51 Quick start: your Databricks audit logs 07:11 Unity Catalog governance & access control 07:53 Splunk-style ad-hoc threat hunting 🔗 Let's Connect: • 🌐 Master Databricks at our official hub: https://nextgenlakehouse.com/ • 📩 Subscribe to our Substack for monthly recaps: https://nextgenlakehouse.com • 💼 Connect with Youssef: https://www.linkedin.com/in/youssefmrini