iFood's security incident response team migrated its in-house SIEM-style platform from Databricks to ClickHouse Cloud, citing 9-16x faster queries at 40-50% lower cost. The move enabled near real-time log ingestion via ClickPipes, adoption of Querybook for analyst notebooks, and ClickStack for observability dashboards. Most notably, it unlocked agentic threat hunting: AI agents running parallel sub-queries can now complete threat hunts that took a human analyst a week in about two hours, drawing on months of historical log data (EDR logs alone generate 1.6TB/day). The team uses Langfuse, now owned by ClickHouse, to observe and tune agent behavior, and plans to migrate CDN/API logs from OpenSearch next.
Table of contents
Hitting a cost ceiling #Cheaper and faster with ClickHouse Cloud #iFood’s new ClickHouse-based architecture #Agentic threat hunting with ClickHouse and Langfuse #Questions this post answers
How much faster is ClickHouse Cloud compared to Databricks for security log analytics?
iFood measured a 9-16x performance boost using ClickHouse Cloud versus its previous Databricks-based setup, while cutting costs by 40-50%. The comparison came from a proof of concept run on one month of real production data, using the same schema and equivalent queries across both platforms, at an operation scale exceeding 130 TB of security logs. Teams weighing ClickHouse against Databricks for log analytics can compare real migration outcomes on daily.dev.
How long does AI-agent-driven threat hunting take compared to manual analyst work?
An AI-agent threat hunt built on ClickHouse Cloud takes roughly two hours, versus about a week for a human analyst working manually. iFood's security team generates 10-15 hypotheses per hunt, runs sub-agents five at a time each executing its own queries, and draws on months of historical EDR log data (1.6 TB/day raw) to test hypotheses at scale. Security engineers exploring agentic threat hunting workflows can track real-world results like this on daily.dev.
What is Langfuse and who owns it now?
Langfuse is an open-source AI observability and evaluations platform used to trace and tune AI agent behavior, such as understanding where an agent's analysis succeeds or falls short. ClickHouse acquired Langfuse, and iFood has since trained more than 500 employees on it for agent telemetry and analytics beyond just its security team. Developers tracking AI observability tool consolidation can follow acquisitions like this on daily.dev.