Databricks Lakewatch

Paid#16 of 25 in Security Analytics

Databricks Lakewatch: A Databricks-native security analytics platform for teams building governed security data applications. Ranked #16 of 25 in Security Analytics by our editors (7.9/10); pricing: Pricing on request; best for databricks-centric security teams.

7.9/10★★★★☆Editor score

Visit Databricks

Databricks Lakewatch7.9 Visit Databricks

At a glance

• Editor score
  7.9 / 10
• Pricing
  Pricing on request
• Best for
  Databricks-centric security teams
• Facts checked
  24 Sep 2026

• Where it wins

  • Normalizes security logs to OCSF and supports indexed search
  • Authors, versions and tests detections as SQL and YAML code
  • Unity Catalog provides governance, access control, auditing and lineage

• Where it doesn't

  • Requires an active Databricks workspace on AWS, Azure or GCP
  • Cloud-only deployment limits teams needing another deployment model
  • Lakewatch pricing is contact-sales, and platform costs vary by product, cloud and region

Our verdict on Databricks Lakewatch

Databricks Lakewatch brings security, IT and business telemetry into the Databricks Data + AI Platform for threat hunting and AI-driven defense. It is aimed at mid-market and enterprise security teams already working in Databricks, particularly those building custom SOC or threat-intelligence applications on security data. Ingest options include Lakeflow Connect, Zerobus and Auto Loader; the platform normalizes logs to OCSF, supports native indexing for search, and provides security case workflows. It requires an active Databricks workspace on AWS, Azure or GCP, so it is not a standalone fit for teams seeking an independent SIEM deployment.

Its strongest fit is for teams treating detection and investigation as data workflows. Detections can be authored, versioned and tested as code using SQL and YAML, while Genie supports natural-language security queries. Agents can triage alerts and summarize investigations. Unity Catalog supplies governance, access control, auditing and lineage across the telemetry. These capabilities connect analytics, detection work and investigation in one platform; they are most relevant where Databricks is already central to security data operations, rather than where a team needs a broad set of separately listed integrations.

According to the vendor's pricing information, Lakewatch uses a contact-sales model, and Databricks platform usage pricing varies by product, cloud and region. The vendor describes unlimited telemetry and long-term retention, without stating numeric limits. Buyers should therefore assess the broader Databricks usage model alongside Lakewatch rather than treating it as a standalone subscription. The cloud-only requirement and reliance on an active workspace make it a poor match for teams needing on-premises deployment or a security analytics tool outside Databricks. Choose it when governed analytics and custom security applications on Databricks are the priority; consider alternatives if platform independence is essential.

Your product? Our editors can test Databricks Lakewatch in depth and publish a review, labelled as paid · from $149/mo →

Databricks Lakewatch pricing

Databricks Lakewatch fact sheet

Alternatives to Databricks Lakewatch

• CrowdStrike Falcon Next-Gen SIEMBroad cloud SIEM with CQL hunting, cross-domain search, and automated response.9.4
• Elastic SecurityFlexible SIEM analytics with extensive detection, hunting, and workflow capabilities.9.3
• FortiSIEMBroad IT/OT event analytics and response for complex security operations.9.2

See all Databricks Lakewatch alternatives →

Featured on iTechGuides

Databricks Lakewatch is listed in our Security Analytics directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/databricks-lakewatch/"><img src="https://www.itechguides.com/best/badge/databricks-lakewatch.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update