Bharat Gamini

Traditional security detection workflows, often confined to proprietary SIEM platforms, struggle to scale, evolve, and integrate with modern data ecosystems. At Adobe, security operations are being reimagined by extending detection capabilities into Databricks using Lakewatch, Unity Catalog, and AI-powered investigation. This approach complements existing SIEM workflows while unlocking new levels of scalability, automation, and data-driven insight. In this session, we present how detection rules are migrated into version-controlled YAML with automated testing and backtesting gates, enabling repeatable and auditable development. By leveraging Lakewatch’s ingestion and normalization of cybersecurity telemetry into OCSF-formatted Delta tables, detections are enriched with both real-time and historical data from Unity Catalog. Detection logic is expressed in SQL and PySpark, with reusable components implemented as SQL UDFs, replacing traditional macro-based approaches. Additionally, we showcase how AI-powered agents transform raw Lakewatch alerts into structured investigation summaries with actionable analyst recommendations, streamlining triage and response. Adobe is modernizing its…

This session will explore how Adobe uses a sophisticated data security architecture built on the Databricks Data Intelligence Platform, along with the Open Cybersecurity Schema Framework (OCSF), to enable scalable, real-time threat detection across more than 10 PB of security data. We’ll compare different approaches to OCSF implementation and demonstrate how Adobe processes massive security datasets efficiently — reducing query times by 18%, maintaining 99.4% SLA compliance, and supporting 286 security users across 17 teams with over 4,500 daily queries. By using Databricks' Platform for serverless compute, scalable architecture, and LLM-powered recommendations, Adobe has significantly improved processing speed and efficiency, resulting in substantial cost savings. We’ll also highlight how OCSF enables advanced cross-tool analytics and automation, streamlining investigations. Finally, we’ll introduce Databricks’ new open-source OCSF toolkit for scalable security data normalization and invite the community to contribute.