Databricks

If your organization has already centralized data in Databricks, you shouldn't have to move it elsewhere to gain detection and investigation capabilities. With Panther's Databricks integration, you can run real-time detections, threat hunting, and security investigations directly on the data lake your engineering and data teams already manage — no duplication, no new infrastructure, no proprietary lock-in.

Use Cases

With Panther and Databricks, you can:

• Apply Panther's real-time detection rules to security telemetry already living in your Databricks environment

• Run threat hunting and investigations against a petabyte-scale data lake using familiar SQL, without context-switching to a separate security tool

• Retain years of normalized security data at cloud storage costs, then query it on demand when an incident requires historical analysis

• Keep security data in your own environment; Databricks stores your data in open formats on your infrastructure, so you stay in control

• Unify security telemetry with the broader business and operational data your teams already use in Databricks, enabling richer investigation context

How It Works

Panther connects to your existing Databricks environment as its data lake backend:

• Point Panther at your Databricks workspace during setup

• Panther writes normalized, structured security data to your Databricks data lake as logs are ingested

• Analysts can search, hunt, and investigate directly from Panther — all queries run against your Databricks environment

Learn how to configure your Databricks data lake backend.