Vibe Investigating with Lakewatch and Genie

Using Lakewatch, the security analytics platform Databricks is building on the Databricks Platform, the walkthrough showed how a natural language, agent-driven workflow compresses repetitive query writing, cross-source pivots, and timeline building, while humans still set scope and validate outcomes. Teams evaluating how AI is transforming data analytics will find the security investigation use case a compelling illustration of what agentic acceleration looks like in practice.

The core message: agents are ready to accelerate the middle of the investigation at scale, but expert judgment, guardrails, and operational security remain essential at the start and finish.

Lakewatch reframes SIEM economics with openness and control

Lakewatch separates storage and compute and relies on open formats in customer-controlled cloud object storage. Teams keep their data and keys, invite compute when needed, scale up or down for investigations, and retain a familiar SIEM experience around data sources, detections, and cases. The approach avoids black-box formats and rigid pricing while aligning with how security teams think about governance and auditability.

Lakewatch is in private preview, with broader availability targeted later in the year, noted as a nonbinding expectation.

Natural language becomes the investigation language, with guardrails

Genie, a multi-turn reasoning agent embedded in Lakewatch, writes queries, correlates across endpoint, network, identity, and threat intel data, and reasons about findings. Analysts steer with hypotheses and natural language, while the agent handles syntax and optimization. Spending hours hand-tuning SPL, KQL, or SQL without AI assistance no longer reflects an efficient workflow.

Configuration matters. Workspace and user-level instructions encode investigative discipline and OPSEC, such as prohibiting sample or hash submission to external services. Skills and instructions can be tailored to a team's methodology, enabling speed without tipping off adversaries.

Agent assistance is middle to middle, not end to end

Agent-supported investigations work best between the opening question and the final call. Analysts decide whether a case merits attention and validate the conclusions. In the demonstration, an informational alert, a beacon to a suspected C2 IP, triggered a full chain reconstruction: beacon cadence analysis, IP-to-hostname pivot via DNS, linkage to an OpenClaw email assistant prompt injection, parent-child process tracing to the initial payload, LSASS credential dumping, and anomalous service account behavior touching OT infrastructure. Genie then assembled a timeline that closely matched the known scenario.

Two cautions stood out. The agent can err, for example prematurely concluding endpoint telemetry was missing, and requires an informed pushback. It also clears easy tasks quickly, concentrating nuanced judgments on the human analyst.

Data sets and evaluation are getting agentic too

Realistic investigative data sets that once took months now emerge in roughly a day when planning agents orchestrate persona, infrastructure, and connector agents. Echo Lake replays historical data into present windows while preserving event deltas, enabling repeatable investigation exercises. Community efforts like botsbench.com offer benchmarks for investigative agents, though training-data contamination in frontier models can blur the line between reasoning and recall.

A practical balance is emerging. Teams can encode investigative doctrine and OPSEC in agent instructions, let the agent generate and replay rich telemetry, and then vet agent output against ground truth to drive ongoing improvement.

Turning acceleration into advantage

Agent-driven speed changes what becomes investigable without adding headcount. Teams that pair strong investigative theory and clear guardrails with Genie's middle-mile acceleration will resolve more cases faster, avoid OPSEC mistakes, and be better positioned as end-to-end automation matures.