NAB is co-designing a SIEM with Databricks

NAB has emerged as one of five “design partners” of a new security information and event management (SIEM) platform being built by Databricks.

The bank’s involvement in co-developing the platform - which also represents Databricks’ first foray into the security market - was revealed late last week.

Called Lakewatch, it is still in “private preview”. It was not immediately clear when it would be generally released by the vendor.

NAB’s chief security officer Sandro Bucchianeri said the bank currently ingests “more than 30TB of security data each day”.

It wanted to “unify these signals” as well as tap into “broader enterprise datasets” to bolster its cyber defence capabilities, Bucchianeri said.

NAB already uses Databricks on AWS as a foundational piece of its enterprise data platform, Ada.

It appears Databricks’ presence in the bank both triggered a conversation about how Ada, and the Databricks technology more broadly, might be useful in a security context.

That, in turn, has led to NAB having a role in co-designing Lakewatch.

"The ability to work in collaboration with Databricks to shape a product to meet the needs of cyber defenders into the future … excites us," Bucchianeri said. 

"We’re building out a platform that's going to work for us, both in terms of what we've been doing historically and where we think we need to move towards.”

Databricks indicated there are 15 security vendors so far, whose data can be brought into Lakewatch.

Aside from promising to bring together security data, Lakewatch is also being marketed as an “agentic” SIEM, where “custom security agents” can be built and run to handle incident detection and response tasks.

The other four co-designers of Lakewatch were not named, however the vendor’s product page lists nine organisations including NAB that “defend with Databricks”, which also includes Atlassian.