Scaling Security Threat Detection with Apache Spark and Databricks
Description
Apple must detect a wide variety of security threats, and rises to the challenge using Apache Spark across a diverse pool of telemetry. This talk covers some of the home-grown solutions we’ve built to address complications of scale: - Notebook-based testing CI – Previously we had a hybrid development model for Structured Streaming jobs wherein most code would be written and tested inside of notebooks, but unit tests required export of the notebook into a user’s IDE along with JSON sample files to be executed by a local SparkSession. We’ve deployed a novel CI solution leveraging the Databricks Jobs API that executes the notebooks on a real cluster using sample files in DBFS. When coupled with our new test-generation library, we’ve seen 2/3 reduction in the amount of time required for testing and 85% less LoC. - Self-Tuning Alerts – Apple has a team of security analysts triaging the alerts generated by our detection rules. They annotate them as either ‘False Positive’ or ‘True Positive’ following the results of their analysis. We’ve incorporated this feedback into our Structured Streaming pipeline, so the system automatically learns from consensus and adjusts future behavior. This h…
Description from YouTube. Full content on the video page.
More from Databricks
NewsHow adidas Uses Databricks to Build Better Products
Adidas uses Databricks' lakehouse platform to centralize all its data—from product to football-related insights—enabling faster analytics across the organization. The company's Genie analytics tool helps analysts spend less time processing data and more time on strategic questions, ultimately supporting better product development.
NewsDatabricks for Good x MapAid: Creating a Searchable Database for Groundwater Discovery
MapAid is using Databricks to build an AI groundwater mapping system called Well Mapper that processes water documents to identify accurate well-drilling locations in Ethiopia, improving on the current 30% success rate. The system analyzes 400 well logs in half a second instead of four weeks, with potential to double Ethiopia's food supply through improved irrigation.
NewsHow Databricks Genie Automates Data Workflows with Genie Ontology and Scheduled Tasks
Databricks Genie enables ontology by default for business context and adds document/PDF uploads, direct Unity Catalog queries, and team collaboration features in chat. Scheduled tasks automate recurring workflows with embedded visualizations and PDF outputs accessible across web, desktop, and mobile platforms.
NewsGenie One Beginner's Guide: Explore Data & Automate Tasks
Genie One helps subject matter experts avoid repetitive questions by using business ontology to understand your data and run real-time queries that generate instant answers and shareable reports. The tool can also automate monitoring with conditional alerts that only notify you when specific business thresholds are met.
TutorialsHow to Schedule Automated Meeting Prep in Genie One
Genie One allows users to connect multiple data sources like Databricks tables and Google Calendar, then create analyses through natural language prompts to prepare for customer meetings. The platform can schedule these analyses to run automatically on a recurring basis and deliver results via email or mobile app.
TutorialsHow to Build Custom Skills in Genie One in Minutes
Genie 1 can populate business report templates by analyzing their format and running SQL queries against organizational data. Users can save these report workflows as reusable skills that execute with a single slash command, enabling automation of recurring reports.