marimoFrom the builder
Why DNB's Cyber Defense Center team moved off Databricks notebooks and onto marimo
An engineer at DNB, Norway's largest financial group, describes how its Cyber Defense Center moved threat detection work off Azure Databricks onto an internal platform of open-source parts, switching storage from Delta to Iceberg and using Ibis to query DuckDB, Spark and Snowflake. marimo became the interface, connecting to Splunk, Databricks and Snowflake from one notebook, with an AI assistant that drafts SPL or Ibis queries. The author says this composable setup makes investigations faster and more systematic.
Security logs from event sources were stored in Delta tables.
Saved . A shortened excerpt from the official blog; the original publisher retains authorship.