Better plumbing in security: Bringing pipes to SQL

SQL has been a mainstay in business applications for decades, but it has traditionally not been a language that security analysts have used for their hunts, investigations or detection logic. Sure, SIEMs have used SQL databases as their data repositories for over 25 years now, but that hasn’t translated into analysts leveraging its language because, let’s face it, SQL traditionally hasn’t been the most fun to use…until now.

With the introduction of pipe syntax to SQL, it’s time to take a fresh look at SQL and how it can be used by security analysts for their daily workloads. During this talk, I will briefly share my initial interactions with SQL early in my career and the power it provides as well as the pain it can create. From there, I will discuss the evolution of SIEMs and their query languages. After this introduction, I will introduce SQL pipes and share how it can be used, how it differs from traditional SQL and how it may be able to alleviate the pain that analysts face with learning different query languages. As an added bonus, SQL pipes may be able to break down silos that separate security from the rest of the organisation and I’ll look at some opportunities where SQL pipes can help in this regard.

To highlight the power that SQL pipes can bring to the security community, I will use example hunt and investigation queries throughout to demonstrate how SQL pipes can be used. Because AI frequently comes up in any cyber security conversation these days, I’ll discuss why moving toward SQL with the corpus of knowledge around it can be a wise choice as well.