Alan Mazankiewicz

Security teams are hitting the limits of traditional SIEM architecture. Rising ingestion costs, fragmented telemetry and brittle detections force tradeoffs between visibility and budget. This session outlines a practical, phased path from SIEM-centric operations to lakehouse-driven security analytics. We will explain how SOC teams have cut costs and boosted performance by offloading telemetry from legacy SIEMs to Databricks, without breaking detections. We’ll also show how security teams run and correlate detections natively across their data sources, and use AI agents to automate detection engineering, tuning, and triage while reducing noise and vendor lock-in. Attendees will leave with a clear roadmap to building a modern, AI-driven SOC on Databricks, and how they can unlock broader detection coverage, lower costs at scale, improved triage efficiency and a realistic path to full SIEM replacement.

SAP Enterprise Cloud Services (ECS) is rethinking the traditional SIEM model by building a Security Data Platform with Lakewatch and Anvilogic shifting to an open, AI-ready foundation for cybersecurity. We’ll walk through how ECS designed and operationalized the platform to replace SIEM-centric workflows with a lakehouse approach that lowers total cost and time to respond using agentic AI. We will discuss the full architecture—routing with Cribl and Kafka, ingestion into Lakewatch, detection engineering in Anvilogic, incident response and reporting. We will close out with agentic AI use cases on the roadmap that are now enabled through the open lakehouse approach.