Databricks Lakewatch review
A Databricks-native security analytics platform for teams building governed security data applications.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Databricks Lakewatch brings security, IT and business telemetry into the Databricks Data + AI Platform for threat hunting and AI-driven defense. It is aimed at mid-market and enterprise security teams already working in Databricks, particularly those building custom SOC or threat-intelligence applications on security data. Ingest options include Lakeflow Connect, Zerobus and Auto Loader; the platform normalizes logs to OCSF, supports native indexing for search, and provides security case workflows. It requires an active Databricks workspace on AWS, Azure or GCP, so it is not a standalone fit for teams seeking an independent SIEM deployment.
Its strongest fit is for teams treating detection and investigation as data workflows. Detections can be authored, versioned and tested as code using SQL and YAML, while Genie supports natural-language security queries. Agents can triage alerts and summarize investigations. Unity Catalog supplies governance, access control, auditing and lineage across the telemetry. These capabilities connect analytics, detection work and investigation in one platform; they are most relevant where Databricks is already central to security data operations, rather than where a team needs a broad set of separately listed integrations.
According to the vendor's pricing information, Lakewatch uses a contact-sales model, and Databricks platform usage pricing varies by product, cloud and region. The vendor describes unlimited telemetry and long-term retention, without stating numeric limits. Buyers should therefore assess the broader Databricks usage model alongside Lakewatch rather than treating it as a standalone subscription. The cloud-only requirement and reliance on an active workspace make it a poor match for teams needing on-premises deployment or a security analytics tool outside Databricks. Choose it when governed analytics and custom security applications on Databricks are the priority; consider alternatives if platform independence is essential.
Databricks Lakewatch pros and cons
- Where it wins
- Normalizes security logs to OCSF and supports indexed search
- Authors, versions and tests detections as SQL and YAML code
- Unity Catalog provides governance, access control, auditing and lineage
- Where it doesn't
- Requires an active Databricks workspace on AWS, Azure or GCP
- Cloud-only deployment limits teams needing another deployment model
- Lakewatch pricing is contact-sales, and platform costs vary by product, cloud and region
Databricks Lakewatch fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update