The Vertex JournalTooling
The lakehouse wants the SIEM's storage bill
Six security-log connectors shipped in one day. Databricks is bidding for the most expensive gigabytes in enterprise logging, and the connectors are the easy half.
By The editors · · 1 min
On September 28 Databricks shipped six security connectors into Lakeflow Connect beta in a single day: Okta system logs, Workday activity logging, Microsoft 365 unified audit logs, CrowdStrike Falcon event streams, Akamai WAF and 1Password event logs, per the September release notes. That is not a coincidence of roadmaps. That is a bid.
The target is the SIEM's storage tier, home of the most expensive gigabytes in enterprise IT. Security vendors price by daily ingest, and audit logs are the canonical high-volume, rarely-queried, kept-for-years workload; land the same rows in object storage as governed tables and the retention math shifts by an order of magnitude. Security teams have known this for years. The answer used to be a homegrown pipeline nobody wanted to own, the kind of operating burden that quietly changes hands rather than disappearing.
What the connectors do not ship is the rest of the SIEM: detection content, correlation rules, case management, the pager rotation. Those are the product. Storage was merely where the margin lived.
Verdict: wait, unless an ingest-priced renewal is on your desk this quarter, in which case forward this to procurement before you sign.