Chained DSL Queries for Reusable Security Analytics

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing security analytics require manual execution of multiple queries in a specific order, which is tedious, error-prone, and resource-intensive, and analysts cannot reuse previous queries due to the lack of technology that allows for the reuse of previously constructed queries as primitives.

Innovation Solution

A method of generating a domain-specific language (DSL) query comprising an ordered set of chained data source-specific queries, where each query is linked to the result of the previous query, allowing for automated execution and reporting of results, including intermediate results, to facilitate efficient and accurate security analytics.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual execution of multiple queries is performed in a specific order, then security analytics can be conducted, but the process becomes tedious, error-prone, and resource-intensive

Engineering Contradiction:

Improveaccuracy of security analyticsVSAvoidmanual effort required

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system enables self-service by implementing automated query execution where the security analytics system automatically chains and executes multiple queries in the correct order without manual intervention. The DSL query processor autonomously handles query composition, execution sequencing, and result aggregation, eliminating the need for manual query management while maintaining analytical accuracy.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system applies preliminary action by pre-defining query templates and execution plans that capture the required query sequences in advance. These pre-configured DSL queries encode the logical relationships and execution orders, allowing the system to automatically reproduce consistent query patterns without manual reconfiguration for each analysis task.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If multiple queries are executed manually in a specific order, then security analytics can be performed, but the process is resource-intensive

Engineering Contradiction:

Improveaccuracy of security analyticsVSAvoidcomputational resources consumed

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system merges multiple individual queries into a unified DSL query structure that represents the entire query chain. By combining query definitions, execution logic, and result aggregation into a single automated process, the system eliminates redundant operations and optimizes resource utilization while maintaining the analytical depth of executing multiple queries in sequence.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The system applies parameter changes by dynamically adjusting query execution parameters based on intermediate results and analytical needs. The DSL query processor optimizes execution plans by modifying query parameters, filtering criteria, and data retrieval scopes in real-time, reducing unnecessary computational overhead while preserving the accuracy required for reliable security analytics.

Inventive Principle:

Principle #35Parameter changes

3Adaptability or versatility

If analysts rewrite or duplicate parts of old queries for every new search, then new use cases can be addressed, but knowledge from previous queries cannot be reused

Engineering Contradiction:

Improveability to address new use casesVSAvoidtime to construct new queries

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The system implements copying by allowing analysts to define query patterns once and reuse them across multiple use cases. The DSL query structure enables copying of proven query templates and chaining logic, which can be adapted to new scenarios by parameter adjustment rather than complete rewriting. This preserves institutional knowledge and reduces repetitive query construction work.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The system achieves universality by designing the DSL query framework to handle diverse security analytics use cases through a common query language and execution engine. The same DSL infrastructure supports various query types, data sources, and analytical objectives, allowing a single unified system to address multiple use cases without requiring separate query construction processes for each scenario.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20250284695A1Chaining of domain specific language-based queries

Publication Date: 2025.09.11 TENABLE INC

AI summary

In an aspect, a component generates a domain-specific language (DSL) query comprising an ordered set of data source-specific queries that comprises a set of chained data source-specific queries. The set of chained data source-specific queries comprises a first data source-specific query and a second data source-specific query that is configured to be executed after the first data source-specific query, with the second data source-specific query being chained to the first data source-specific query via a first field of the second data source-specific query that is linked to a first intermediate result of the first data source-specific query. The component executes the DSL query to derive a set of results comprising: a DSL query result associated with the set of chained data source-specific queries, and a set of intermediate results associated with the set of chained data source-specific queries. The component reports information associated with the set of results.