Public production architecture teardown
Ziggiz — Cyber Lakehouse-as-a-Service on Databricks
First public production reference to ship the Databricks-native Cyber Lakehouse pattern as a service — Delta Lake for storage, Unity Catalog for governance, Spark for batch normalization, separated storage and compute. Tenant onboarding compressed from a 9-month enterprise build to a 5-day managed deployment. DARPA-funded for entity enrichment; selected by Palantir's startup fellowship for asset management.
Tenant onboarding for new Cyber Lakehouse customers — documented in Ziggiz's A.Team case. Cost savings claim is 30-50% versus three leading SIEMs (per Ziggiz's own press materials), not the higher 90% figure that circulates in derivative coverage. Treat the onboarding number as the claim the case rests on.
The pipeline
Sources
Security telemetry feeds
EDR · cloud · identity · network — tenant-specific connectors
Normalize
Apache Spark on Databricks
Schema-on-write; entity enrichment (DARPA-funded line)
Store
Delta Lake
Time travel; ACID writes; columnar Parquet under the hood
Govern
Unity Catalog
Tenant isolation; lineage; access policy at the table layer
Serve
SOC + analyst surfaces
Cyber Lakehouse query plane; Alpha Level integration for alert refinement
What composes, what’s brittle
- 9 mo → 5 days. Onboarding shrunk by ~50× in the published A.Team case.
- 30-50% cost. Ziggiz's own claim versus three leading SIEMs — narrower than the 90% figure that circulates downstream.
- Why Databricks. Delta + Unity + separated compute lets a small vendor offer multi-tenant lakehouse security as a service without rebuilding the platform.
- DARPA validation. Independent technical review funding for entity enrichment — rare third-party signal in the cyber-lakehouse vendor field.
- Composes with. Alpha Level Alert Refinery for SOC alert fatigue; Palantir startup fellowship for physical-asset management overlay.
- What's brittle. Single-vendor lakehouse coupling (Databricks lock-in); the cost claim narrows under scrutiny — Ziggiz publishes 30-50%, not 90%; small-vendor maturity vs. Splunk/Sentinel install base.
Sources: Ziggiz press release, "DARPA validates what security teams always suspected" · Ziggiz + Alpha Level partnership announcement · Databricks "Data Intelligence for Cybersecurity" launch (March 2026, names Ziggiz as a partner).