Case Study

Databricks Lakewatch: The Investigation Workbench

Three to four separate alert pages became one investigation that analysts can verify in minutes instead of rebuilding by hand.

Three to four separate alert pages became one investigation that analysts can verify in minutes instead of rebuilding by hand.

ROLE

Lead Product Designer (sole designer)

TEAM

2 product managers, 1 tech lead, 1 engineering manager, platform engineers (confirm count)

TIMELINE

Sep to Oct 2026 design, Milestone 1 build starting Nov 2026 (confirm)

COMPANY

Databricks, Lakewatch (agentic SIEM)

The problem

Our AI agent, Genie, could triage one security alert at a time, but real attacks set off several alerts at once. Analysts had to open each alert, read a separate AI summary, and piece the story together in their heads, while the agent forgot everything between runs. We needed one place where the AI’s work could add up and a person could still check it before acting.

Key decisions

01

Put the agent beside the evidence, not on top of it

The early prototypes opened details in overlay drawers and floated chat on top of the page, which hid the very evidence an analyst was asking about. I moved to a split screen: the investigation’s stateful parts (summary, tasks, findings) stack on the left, and Genie and the detail panes sit on the right. Analysts told us their main move is “look at this, then ask about it,” so chat had to stay open while they read.

02

Let Genie do the writing, keep the human in charge

The team decided to drop manual task and finding entry. Nobody was going to type out a full finding by hand, and Genie-written records kept the data clean. I agreed, but I pushed to keep one direct control: a Rerun button on every task, even though the plan was to route everything through chat. Analysts don’t trust what they can’t redo, so they rerun a failed or doubtful task in one click, and only a person can confirm the verdict and close an investigation.

03

Design the timeline around the gaps

Analysts rebuild an attack by asking “what happened next, and how long after?” Instead of listing raw timestamps, I labeled the space between events (“8h 37m later”) and added a histogram across the top so bursts of activity stand out at a glance. Clicking any event opens its evidence in the side panel, so checking the AI’s story never takes you off the page.

Results

Currently in beta

← Previous case study

Next case study →