SECURITY

Databricks acquires cyberattack detection startup Panther

Databricks Inc. today announced plans to acquire Panther Labs Inc., a startup with an artificial intelligence platform for detecting cyberattacks.

The companies didn’t disclose the financial terms. Panther received a $1.4 billion valuation in a 2021 funding round that included contributions from Snowflake Ventures, Coatue and other prominent backers.

Understanding the scope of a cyberattack requires a reviewing a significant amount of telemetry. However, organizations often have only partial data about breaches because collecting all the necessary information can be prohibitively expensive. Panther’s platform includes filters that remove noise from telemetry streams, which reduces costs and thereby makes it possible to collect more high-value breach data.

The platform not only gathers telemetry but also organizes it in a format that eases analysis. From there, Panther scans the data for threats using customer-provided detections. A detection is a snippet of code designed to spot a specific type of malicious activity. Some companies have upwards of hundreds of such code snippets.

Panther includes an AI tool that enables customers to create detections using natural language prompts. When a detection generates a false positive, another AI module finds the root cause and suggests code changes. Panther implements detections in Python, a relatively simple language that enables developers to quickly make customizations.

The platform also supports a second programming syntax called PantherFlow. According to the company, customers can use it to run queries on cybersecurity logs. For example, an administrator investigating a breach that occurred in the past day can write a PantherFlow script that brings up recent access logs from the affected systems.

Panther generates a natural language description of each cybersecurity risk that it finds. It enriches the data with external information such as threat intelligence. As a result, the platform can highlight the vulnerabilities that should be fixed first because they’re being actively targeted by hackers.

Panther offers its software in two flavors. There’s a managed version and an edition optimized to run on cloud data platforms such as Databricks. According to Panther, the latter offering enables enterprises to analyze their cybersecurity logs without moving them.

Databricks will use the company’s technology to expand its breach detection capabilities. In March, the analytics giant introduced a product called Lakewatch that enables enterprises to collect and analyze cybersecurity logs from multiple sources. Databricks says Panther’s software will speed up tasks such as developing breach remediation plans.

“With Panther, we enhance and expand our ability to analyze all data and automate SOC workflows,” said Databricks co-founder and Chief Executive Officer Ali Ghodsi.

Panther is the third cybersecurity startup that the company has acquired since the start of the year. Databricks previously bought data encryption specialist Antimatter Inc. and SiftD Inc., which built a platform for automating breach remediation tasks. 

Photo: Robert Hof/SiliconANGLE