Our security & AI experts run a live threat hunt with Claude on Realm-optimized data in Databricks, starting from nothing but a CISA advisory and a table name. If you want to go further, we run it on a sample of your own logs next.
We hunt for Medusa ransomware, one of the most active threats facing large enterprises, using the joint CISA and FBI advisory as the agent's only brief.
The agent gets the CISA advisory and a table name in Databricks. No hand-built queries, no hints about where to look.
Email, firewall, and Windows logs, with the malicious activity buried in normal traffic from the same period, the way it would be in your environment.
The agent writes SQL against parsed fields, OCSF-aligned observables, and enrichments, so it can follow one user or one IP from source to source.
We show the pitfalls to avoid when you put an agent on security data, and what changes when the data arrives in Realm lake format.
realm_threat_hunt.Attack activity is synthetic, generated from the indicators in the advisory.
An agent pointed at raw vendor logs spends its effort working out what the data says. On Realm lake format, it spends that effort hunting.
One long string per event, different for every source
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing"/><EventID>4688</EventID><TimeCreated SystemTime="2026-09-18T14:02:11Z"/><Computer>WS-0412</Computer></System><EventData><Data Name="SubjectUserName">jsmith</Data><Data Name="NewProcessName">C:\Windows\System32\...
Every event as one consistent record
You bring the agent and the lake. Realm makes the data worth hunting on.
If the session lands, we take one of your sources through the same process. It's your call, and there's no obligation.
A firewall, email, or endpoint source you already collect. A sample is enough.
It lands in a lake in Realm lake format, with the parsed fields, observables, and enrichments attached.
Your team sees an agent query your own data, and what it takes to do that in production.
No. It's a working session led by our security & AI experts, the people building how Realm feeds agents. Bring your hardest questions about putting AI on your security data.
Not for the first session. The hunt runs on synthetic attack data built from the advisory. Running it on a sample of your own logs is an optional next step.
No. We use them to show the approach, but Realm lake format is open JSON and destination-agnostic, so the same approach works with the lake and agent you choose.
Whoever owns your AI SOC plans. That's usually a SOC leader, a detection or threat hunting lead, and someone from your security data or data engineering team.
Thirty minutes with our security & AI experts, and one live hunt.
Book your 30-minute session