Lakewatch
An agentic SIEM as a native application on a workspace: telemetry lands in open formats normalised to OCSF, Lakeflow Connect ingests it, Genie hunts in natural language, Agent Bricks agents triage and respond, and detections are code.
Why it is worth watching
Private Preview since March 2026 with named customers; no documentation page exists, so the announcement carries the label until one does.
What Private Preview promises
Invite only, through your account team, and not for production. Here so you know it exists, not so you can plan around it.
| Who can use it | Invite only |
|---|---|
| Production use | No |
| Support | Engineering only |
| On by default | No |
The definitions are Databricks' own, on its release types page. The label on this page is the one the feature's documentation states, last checked on 25 Sept 2026.
Where to read more
We have not written a concept about it yet: while it is in preview the documentation is the place to read, and it moves faster than a page here would.