NATIVE IP FUNCTIONS FOR THREAT DETECTION AND HUNTING ON DATABRICKS

Summary from the TLDR IT newsletter

Databricks now offers built-in SQL IP functions in Public Preview for IPv4 and IPv6 subnet checks, CIDR arithmetic, parsing, and canonicalization. They simplify threat-hunting workflows like separating internal and external traffic and matching telemetry against threat-intel blocklists. Tests on a live Lakewatch workspace found they handle tricky IPv6 formats more reliably than regex or integer-based methods and outperform UDFs with Photon join optimizations.