How ClickHouse's security team uses ClickHouse Security

Date: Thursday, December 3, 2026

Time: 10:00 a.m. PT / 1:00 p.m. ET

Duration: 40 minutes (30 minute session + 10 minutes of live Q&A)

Location: Virtual (register for a Zoom link)

What if your SIEM ran on the same platform as the rest of your data, your team could write detections in SQL with AI to help, and investigating a threat meant asking questions in plain language?

See how the ClickHouse security team uses ClickHouse Security, now in private preview, to build detections and investigate threats.

ClickHouse Security is an agentic SIEM built on technology from RunReveal and integrated with ClickHouse Cloud. It brings first-party integrations, built-in pipelines, managed and custom detections, and native AI agents to a ClickHouse service you already own.

In this session, Morgan Fenton, Senior Incident Response Security Engineer at ClickHouse, will walk through how the team works in ClickHouse Security day to day.

You'll learn how they:

• Use ClickHouse Security end to end, from first-party sources and built-in pipelines to detections and cases
• Write detections in SQL, with AI to help, and manage them as code: one rule per file in Git, peer-reviewed by pull request, and deployed with the CLI and GitHub Action
• Test every detection before it goes live, using their own framework that runs each rule's SQL against sample events in CI, so a rule is proven to fire on a real attack and not false-positive
• Use AI agents and natural-language chat to investigate threats faster

This 30 minute live session includes a product walkthrough and a look at the team's real workflow, followed by 10 minutes of live Q&A with Evan Johnson, CEO of RunReveal, joining.

Who should attend? Security engineers, detection and response engineers, cloud security engineers, SOC analysts and incident responders, security architects, and security leaders, as well as platform and data teams already running ClickHouse who want to see how security data fits in.

Want to try it yourself? Request access to the ClickHouse Security private preview.