--- title: How iFood built its agentic security platform on... description: iFood's security incident response team migrated its in-house SIEM-style platform from Databricks to ClickHouse Cloud, citing 9-16x faster queries at 40-50%... canonical: https://daily.dev/posts/how-ifood-built-its-agentic-security-platform-on-clickhouse-cloud-0yktjc5xt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How iFood built its agentic security platform on ClickHouse Cloud | daily.dev og:description: iFood's security incident response team migrated its in-house SIEM-style platform from Databricks to ClickHouse Cloud, citing 9-16x faster queries at 40-50%... og:url: https://daily.dev/posts/how-ifood-built-its-agentic-security-platform-on-clickhouse-cloud-0yktjc5xt og:image: https://api.daily.dev/og/posts/0yktjC5Xt.png og:image:alt: How iFood built its agentic security platform on ClickHouse Cloud og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How iFood built its agentic security platform on ClickHouse Cloud **[ClickHouse](https://daily.dev/sources/clickhouse)** · 8 min read · 0 upvotes · 0 comments ## Summary iFood's security incident response team migrated its in-house SIEM-style platform from Databricks to ClickHouse Cloud, citing 9-16x faster queries at 40-50% lower cost. The move enabled near real-time log ingestion via ClickPipes, adoption of Querybook for analyst notebooks, and ClickStack for observability dashboards. Most notably, it unlocked agentic threat hunting: AI agents running parallel sub-queries can now complete threat hunts that took a human analyst a week in about two hours, drawing on months of historical log data (EDR logs alone generate 1.6TB/day). The team uses Langfuse, now owned by ClickHouse, to observe and tune agent behavior, and plans to migrate CDN/API logs from OpenSearch next. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How much faster is ClickHouse Cloud compared to Databricks for security log analytics? iFood measured a 9-16x performance boost using ClickHouse Cloud versus its previous Databricks-based setup, while cutting costs by 40-50%. The comparison came from a proof of concept run on one month of real production data, using the same schema and equivalent queries across both platforms, at an operation scale exceeding 130 TB of security logs. _Teams weighing ClickHouse against Databricks for log analytics can compare real migration outcomes on daily.dev._ ### How long does AI-agent-driven threat hunting take compared to manual analyst work? An AI-agent threat hunt built on ClickHouse Cloud takes roughly two hours, versus about a week for a human analyst working manually. iFood's security team generates 10-15 hypotheses per hunt, runs sub-agents five at a time each executing its own queries, and draws on months of historical EDR log data (1.6 TB/day raw) to test hypotheses at scale. _Security engineers exploring agentic threat hunting workflows can track real-world results like this on daily.dev._ ### What is Langfuse and who owns it now? Langfuse is an open-source AI observability and evaluations platform used to trace and tune AI agent behavior, such as understanding where an agent's analysis succeeds or falls short. ClickHouse acquired Langfuse, and iFood has since trained more than 500 employees on it for agent telemetry and analytics beyond just its security team. _Developers tracking AI observability tool consolidation can follow acquisitions like this on daily.dev._ ## Similar posts on daily.dev - [Intelligent security at ClickHouse speed: How Cogent Security built an AI-native vulnerability management platform](https://daily.dev/posts/intelligent-security-at-clickhouse-speed-how-cogent-security-built-an-ai-native-vulnerability-manag-obfsc8odp) · ClickHouse · 1 upvotes · 0 comments - [How Fetch built its flexible agentic analytics tool on ClickHouse Cloud](https://daily.dev/posts/how-fetch-built-its-flexible-agentic-analytics-tool-on-clickhouse-cloud-vgqz82ofs) · ClickHouse · 0 upvotes · 0 comments - [Escaping the SIEM Cost Trap: A Data-First Architecture for Security Analytics](https://daily.dev/posts/escaping-the-siem-cost-trap-a-data-first-architecture-for-security-analytics-u22175hat) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#agentic-ai](https://daily.dev/tags/agentic-ai), [#clickhouse](https://daily.dev/tags/clickhouse) [View this post on daily.dev](https://daily.dev/posts/how-ifood-built-its-agentic-security-platform-on-clickhouse-cloud-0yktjc5xt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How iFood built its agentic security platform on ClickHouse Cloud","url":"https://daily.dev/posts/how-ifood-built-its-agentic-security-platform-on-clickhouse-cloud-0yktjc5xt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-ifood-built-its-agentic-security-platform-on-clickhouse-cloud-0yktjc5xt"},"datePublished":"2026-08-12T15:20:44.992Z","dateModified":"2026-08-12T15:21:13.124Z","description":"iFood's security incident response team migrated its in-house SIEM-style platform from Databricks to ClickHouse Cloud, citing 9-16x faster queries at 40-50%...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9e284b50a95f91791f13b9d00872fa2b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9e284b50a95f91791f13b9d00872fa2b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ClickHouse","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ClickHouse","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/clickhouse","url":"https://daily.dev/sources/clickhouse"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-ifood-built-its-agentic-security-platform-on-clickhouse-cloud-0yktjc5xt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,agentic-ai,clickhouse","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ClickHouse","item":"https://daily.dev/sources/clickhouse"},{"@type":"ListItem","position":3,"name":"How iFood built its agentic security platform on ClickHouse Cloud"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-ifood-built-its-agentic-security-platform-on-clickhouse-cloud-0yktjc5xt#faq","mainEntity":[{"@type":"Question","name":"How much faster is ClickHouse Cloud compared to Databricks for security log analytics?","acceptedAnswer":{"@type":"Answer","text":"iFood measured a 9-16x performance boost using ClickHouse Cloud versus its previous Databricks-based setup, while cutting costs by 40-50%. The comparison came from a proof of concept run on one month of real production data, using the same schema and equivalent queries across both platforms, at an operation scale exceeding 130 TB of security logs. Teams weighing ClickHouse against Databricks for log analytics can compare real migration outcomes on daily.dev."}},{"@type":"Question","name":"How long does AI-agent-driven threat hunting take compared to manual analyst work?","acceptedAnswer":{"@type":"Answer","text":"An AI-agent threat hunt built on ClickHouse Cloud takes roughly two hours, versus about a week for a human analyst working manually. iFood's security team generates 10-15 hypotheses per hunt, runs sub-agents five at a time each executing its own queries, and draws on months of historical EDR log data (1.6 TB/day raw) to test hypotheses at scale. Security engineers exploring agentic threat hunting workflows can track real-world results like this on daily.dev."}},{"@type":"Question","name":"What is Langfuse and who owns it now?","acceptedAnswer":{"@type":"Answer","text":"Langfuse is an open-source AI observability and evaluations platform used to trace and tune AI agent behavior, such as understanding where an agent's analysis succeeds or falls short. ClickHouse acquired Langfuse, and iFood has since trained more than 500 employees on it for agent telemetry and analytics beyond just its security team. Developers tracking AI observability tool consolidation can follow acquisitions like this on daily.dev."}}]} ```