Databricks (Beta)

Overview

Using Databricks as your data lake is in open beta and is available to all customers. Please share any bug reports and feature requests with your Panther support team.

Panther supports using Databricks as your data lake backend to store and search data.

See the available databases here. The panther_rule_matches, panther_rule_errors, and panther_views databases are not supported in Databricks.

Panther features not supported on Databricks

Certain Panther features cannot be used with a Databricks backend, either because of a Panther-side or Databricks-side limitation. These features include:

• Correlation rules

• Search optimization (aka indexing)

• RBAC per log type

  • A workaround is Databricks Unity Catalog

• Alerts are not stored in and queryable from the data lake

• Query performance is slightly reduced compared to Snowflake