Alysson Souza

Security data is among the most sensitive in the enterprise, yet many SIEM deployments lack consistent, fine-grained governance. Learn how Lakewatch leverages Unity Catalog to provide centralized governance across your entire security ecosystem. We will dive deep into the Lakewatch RBAC model, demonstrating how to manage Principals (Users, Groups, and Service Principals) across protected resources like Datasources, Detection Rules, and Notables. You’ll learn how to implement Lakewatch’s unique inherited permission model — where cases automatically inherit context from parent resources — to streamline investigations while maintaining strict "need-to-know" access. Takeaways include: implementing table, row, and column-level security for telemetry; defining Viewer, Creator, and Manager scopes at Workspace and Resource levels; practical patterns for SOC, cloud, and data teams to collaborate safely; sharing data with partners via Delta Sharing without compromising auditability or lineage.

Legacy SIEMs are drowning security teams in alerts but starving them of insight. As threats grow more complex and attackers operate at machine speed, cybersecurity must be treated as a data and AI problem at scale. In this session, we'll walk through a Cybersecurity Intelligence Platform powered by Lakewatch, Databricks' open, agentic SIEM. We'll show how to streamline security data ingestion and automated cloud log collection, then rapidly normalize it into the OCSF standard to cut time-to-value. From there, we'll explore large-scale analytics, behavioural ML, and Detection-as-Code workflows that bring software engineering rigor to detection and response. The highlight is Agentic Threat Hunting with Lakewatch: AI agents that reason over security signals alongside business and application data, leveraging internal knowledge to add critical context, reduce false positives, and automate complex triage. Join us to see how modern SOCs can move beyond the traditional SIEM toward true security intelligence with Lakewatch and the Databricks Data Intelligence Platform.

Most AI agents break when they leave the lab. This session shows you how to build ones that don't — using Databricks as your security-first production backbone.You'll see battle-tested architectural patterns for three real-world scenarios: internal productivity agents with least-privilege access, agents that securely connect to external tools and MCP servers, and governed B2C agents serving non-Databricks users through external web apps.At the core: Unity Catalog as your governance engine. We go deep on passing OAuth identity claims into UC functions for row-level data retrieval, applying identity-based filters within Vector Search, and enforcing tool-level restrictions that travel with your agent across every access pattern.You'll leave with: a reusable architectural blueprint for production agent deployment, concrete techniques for identity-aware data access, and a governance model that scales without becoming a bottleneck.Start shipping agents you can trust with Databricks.