--- title: Databricks pitches Lakewatch as a cheaper SIEM — but is... description: Databricks has previewed Lakewatch, an open agentic SIEM built on its lakehouse architecture. Unlike traditional SIEMs that charge per data ingested, Lakewatch... canonical: https://daily.dev/posts/databricks-pitches-lakewatch-as-a-cheaper-siem-but-is-it-really--wxes2qppc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Databricks pitches Lakewatch as a cheaper SIEM — but is it really? | daily.dev og:description: Databricks has previewed Lakewatch, an open agentic SIEM built on its lakehouse architecture. Unlike traditional SIEMs that charge per data ingested, Lakewatch... og:url: https://daily.dev/posts/databricks-pitches-lakewatch-as-a-cheaper-siem-but-is-it-really--wxes2qppc og:image: https://api.daily.dev/og/posts/wXEs2qPPc.png og:image:alt: Databricks pitches Lakewatch as a cheaper SIEM — but is it really? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Databricks pitches Lakewatch as a cheaper SIEM — but is it really? **[InfoWorld](https://daily.dev/sources/infoworld)** · 3 min read · 1 upvotes · 0 comments ## Summary Databricks has previewed Lakewatch, an open agentic SIEM built on its lakehouse architecture. Unlike traditional SIEMs that charge per data ingested, Lakewatch charges based on compute usage, which Databricks claims can reduce total cost of ownership by up to 80% while enabling retention of years of queryable security data. Analysts partially agree — the ingestion cost problem in legacy SIEMs is real — but warn that costs shift to compute rather than disappear, and uncontrolled usage could negate savings. Lakewatch integrates Unity Catalog, Lakeflow Connect, and the Open Cybersecurity Schema Framework (OCSF) to centralize security operations. Analysts see it as more likely to complement existing SIEMs than replace them in the near term, with early adoption expected from large enterprises already on Databricks. The company's acquisitions of Antimatter and SiftD.ai suggest a broader long-term security portfolio ambition. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Why CISOs Are Building Open Security Lakes with Iceberg](https://daily.dev/posts/why-cisos-are-building-open-security-lakes-with-iceberg-kawnuzoou) · Confluent Blog · 0 upvotes · 0 comments - [Reducing the noise: How Atlassian built an OCSF security lakehouse on Databricks](https://daily.dev/posts/reducing-the-noise-how-atlassian-built-an-ocsf-security-lakehouse-on-databricks-3pobgk3m5) · databricks · 2 upvotes · 0 comments - [Escaping the SIEM Cost Trap: A Data-First Architecture for Security Analytics](https://daily.dev/posts/escaping-the-siem-cost-trap-a-data-first-architecture-for-security-analytics-u22175hat) · Security Boulevard · 0 upvotes · 0 comments - [Databricks buys Panther Labs in cybersecurity push](https://daily.dev/posts/databricks-buys-panther-labs-in-cybersecurity-push-dhxuuc7ne) · The Next Web · 0 upvotes · 0 comments - [AWS CloudWatch Evolves into Unified Observability Platform with Apache Iceberg Support](https://daily.dev/posts/aws-cloudwatch-evolves-into-unified-observability-platform-with-apache-iceberg-support-z4emjmdxn) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-engineering](https://daily.dev/tags/data-engineering), [#databricks](https://daily.dev/tags/databricks), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/databricks-pitches-lakewatch-as-a-cheaper-siem-but-is-it-really--wxes2qppc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Databricks pitches Lakewatch as a cheaper SIEM — but is it really?","url":"https://daily.dev/posts/databricks-pitches-lakewatch-as-a-cheaper-siem-but-is-it-really--wxes2qppc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/databricks-pitches-lakewatch-as-a-cheaper-siem-but-is-it-really--wxes2qppc"},"datePublished":"2026-03-26T12:47:05.119Z","dateModified":"2026-03-26T12:47:41.274Z","description":"Databricks has previewed Lakewatch, an open agentic SIEM built on its lakehouse architecture. Unlike traditional SIEMs that charge per data ingested, Lakewatch...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/381475b3c91a3941395fb13f9b92fc46?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/381475b3c91a3941395fb13f9b92fc46?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoWorld","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoWorld","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/bf6d68a999064029b0bb09aa6268f1f3","url":"https://daily.dev/sources/infoworld"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/databricks-pitches-lakewatch-as-a-cheaper-siem-but-is-it-really--wxes2qppc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-engineering,databricks,agentic-ai","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoWorld","item":"https://daily.dev/sources/infoworld"},{"@type":"ListItem","position":3,"name":"Databricks pitches Lakewatch as a cheaper SIEM — but is it really?"}]} ```