We have a modern enterprise with numerous security technologies, making it difficult to manage the vast amount of data generated by these tools. Traditional SIEMs struggle to handle this complexity due to immutable time series event data and lack of normalization, leading to performance issues and difficulties in querying the data. To overcome these challenges, Dassana, a security data lake, uses ClickHouse as its backbone, leveraging its flexibility, scalability, and cost-effectiveness. By utilizing advanced features like table engines, asynchronous inserts, and dictionaries, ClickHouse enables Dassana to normalize and query the disparate data sources, providing contextualized insights and simplifying data access at scale.