Business Problem

Today, the average Fortune 1000 company manages over 40+ cybersecurity vendors. The sheer number of enterprise cybersecurity toolsets, each capturing and generating its own data, creates significant data management and data engineering challenges for all enterprises. Because each of these security tools has separate logs, outputs, and databases, it prevents any security team from meaningfully understanding their overall security posture and using their own data effectively.

Scope

Show how treating cybersecurity as a data management problem, and subsequently opening disparate cybersecurity data to queries can help organizations - Secure their systems and data more effectively. - Practitioners will walk away understanding the value of modeled and organized security on a data warehouse - Leverage real-world data that shows how Databricks Security Lake can help solve vulnerability management and end-to-end workflows for security practitioners.

---

jwalker@monad.com

---

IMAGE TO REFERENCE ARCHITECTURE

---

© 2022 Databricks, Inc. All rights reserved. The source in this notebook is provided subject to the Databricks License [https://databricks.com/db-license-source]. All included or referenced third party libraries are subject to the licenses set forth below.

library	description	license	source
PyYAML	Reading Yaml files	MIT	https://github.com/yaml/pyyaml

Getting started

Although specific solutions can be downloaded as .dbc archives from our websites, we recommend cloning these repositories onto your databricks environment. Not only will you get access to latest code, but you will be part of a community of experts driving industry best practices and re-usable solutions, influencing our respective industries.

To start using a solution accelerator in Databricks simply follow these steps:

1. Clone solution accelerator repository in Databricks using Databricks Repos
2. Attach the RUNME notebook to any cluster and execute the notebook via Run-All. A multi-step-job describing the accelerator pipeline will be created, and the link will be provided. The job configuration is written in the RUNME notebook in json format.
3. Execute the multi-step-job to see how the pipeline runs.
4. You might want to modify the samples in the solution accelerator to your need, collaborate with other users and run the code samples against your own data. To do so start by changing the Git remote of your repository to your organization’s repository vs using our samples repository (learn more). You can now commit and push code, collaborate with other user’s via Git and follow your organization’s processes for code development.

The cost associated with running the accelerator is the user's responsibility.

Project support

Please note the code in this project is provided for your exploration only, and are not formally supported by Databricks with Service Level Agreements (SLAs). They are provided AS-IS and we do not make any guarantees of any kind. Please do not submit a support ticket relating to any issues arising from the use of these projects. The source in this project is provided subject to the Databricks License. All included or referenced third party libraries are subject to the licenses set forth below.

Any issues discovered through the use of this project should be filed as GitHub Issues on the Repo. They will be reviewed as time permits, but there are no formal SLAs for support.