Distributing search loads to optimize security event processing

1. A computer-implemented method performed by a security server, comprising:

creating structured or semi-structured documents upon occurrences of security events, wherein the structured or semi-structured documents are stored in a document store and at least some of the structured or semi-structured documents are stored locally at the security server in a document index;

storing a mapping file that maps search fields used in domain specific language (DSL) queries recognized by a distributed search cluster to keys in the structured or semi-structured documents;

intercepting a search request comprising a DSL query directed to the distributed search cluster;

determining that a structured or semi-structured document in the document index matches the DSL query in the search request; and

in response to the determination of the matching:

inhibiting an event processing application executing on the security server from forwarding the search request to the distributed search cluster; and

answering the search request at the security server using the structured or semi-structured document in the document index, without using the distributed search cluster or the document store.

2. The computer-implemented method of claim 1 , further comprising:

receiving an input identifying one or more security events applicable to a task to be performed by execution of the search request comprising the DSL query.

3. The computer-implemented method of claim 2 , wherein

the DSL query comprises one or more comparison statements, and

each comparison statement of the one or more comparison statements comprises a search field, a comparison operator, and one or more values.

4. The computer-implemented method of claim 3 , further comprising:

maintaining a metadata file that includes a list of the search fields and corresponding data types.

5. The computer-implemented method of claim 4 , wherein

the mapping file indicates one or more keys in the structured or semi-structured document mapped to one or more search fields in the DSL query, and

the one or more values represent the one or more keys in the structured or semi-structured document.

6. The computer-implemented method of claim 5 , further comprising:

parsing the DSL query into the one or more comparison statements; and

for each comparison statement;

accessing the mapping file;

identifying a key of the one or more keys in the structured or semi-structured document utilizing a search field of the one or more search fields;

parsing the structured or semi-structured document;

extracting an associated value of the key utilizing the key in the structured or semi-structured document; and

parsing the value or converting the value to an expected data type indicated in the metadata file.

7. The computer-implemented method of claim 6 , further comprising:

comparing the associated value with a value specified in the DSL query; and

determining whether the structured or semi-structured document matches the DSL query.

8. The computer-implemented method of claim 7 , further comprising:

determining whether the DSL query comprises a plurality of comparison statements; and

repeating the comparing for each comparison statement of the plurality of comparison statements if the DSL query comprises the plurality of comparison statements.

9. The computer-implemented method of claim 1 , wherein

the search request comprises a hypertext transfer protocol (HTTP) request,

the distributed search cluster is implemented by a search server,

the structured or semi-structured document is a JavaScript Object Notation (JSON) document, and

the JSON document represents a security event that identifies a security vulnerability associated with a computing device communicatively coupled to the security server.

10. A non-transitory computer readable storage medium comprising program instructions executable by one or more processors of a security server to:

create structured or semi-structured documents upon occurrences of security events, wherein the structured or semi-structured documents are stored in a document store and at least some of the structured or semi-structured documents are stored locally at the security server in a document index;

store a mapping file that maps search fields used in domain specific language (DSL) queries recognized by a distributed search cluster to keys in the structured or semi-structured documents;

intercept a search request comprising a DSL query directed to the distributed search cluster;

determine that a structured or semi-structured document in the document index matches the DSL query in the search request; and

in response to the determination of the matching:

inhibit an event processing application executing on the security server from forwarding the search request to the distributed search cluster; and

answer the search request at the security server using the structured or semi-structured document in the document index, without using the distributed search cluster or the document store.

11. The non-transitory computer readable storage medium of claim 10 , wherein the program instructions are executable to:

receive an input identifying one or more security events applicable to a task to be performed by execution of the search request comprising the DSL query.

12. The non-transitory computer readable storage medium of claim 11 , wherein

the DSL query comprises one or more comparison statements, and

each comparison statement of the one or more comparison statements comprises a search field, a comparison operator, and one or more values.

13. The non-transitory computer readable storage medium of claim 12 , wherein

the mapping file indicates one or more keys in the structured or semi-structured document mapped to one or more search fields in the DSL query, and

the one or more values represent the one or more keys in the structured or semi-structured document.

14. The non-transitory computer readable storage medium of claim 13 , wherein the program instructions are executable to:

parse the DSL query into the one or more comparison statements;

for each comparison statement;

access the mapping file;

identify a key of the one or more keys in the structured or semi-structured document utilizing a search field of the one or more search fields;

parse the structured or semi-structured document;

extract an associated value of the key utilizing the key in the structured or semi-structured document; and

parse the value or converting the value to an expected data type indicated in the metadata file;

compare the associated value with a value specified in the DSL query;

determine whether the structured or semi-structured document matches the DSL query;

determine whether the DSL query comprises a plurality of comparison statements; and

repeat the comparing for each comparison statement of the plurality of comparison statements if the DSL query comprises the plurality of comparison statements.

15. The non-transitory computer readable storage medium of claim 10 , wherein

the search request comprises a hypertext transfer protocol (HTTP) request,

the distributed search cluster is implemented by a search server,

the structured or semi-structured document is a JavaScript Object Notation (JSON) document, and

the JSON document represents a security event that identifies a security vulnerability associated with a computing device communicatively coupled to the security server.

16. A system comprising:

one or more processors of a security server; and

a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to cause the security server to:

create structured or semi-structured documents upon occurrences of security events, wherein the structured or semi-structured documents are stored in a document store and at least some of the structured or semi-structured documents are stored locally at the security server in a document index;

store a mapping file that maps search fields used in domain specific language (DSL) queries recognized by a distributed search cluster to keys in the structured or semi-structured documents;

intercept a search request comprising a DSL query directed to the distributed search cluster;

determine that a structured or semi-structured document in the document index matches the DSL query in the search request; and

in response to the determination of the matching:

inhibit an event processing application executing on the security server from forwarding the search request to the distributed search cluster; and

answer the search request at the security server using the structured or semi-structured document in the document index, without using the distributed search cluster or the document store.

17. The system of claim 16 , wherein

the DSL query comprises one or more comparison statements, and

each comparison statement of the one or more comparison statements comprises a search field, a comparison operator, and one or more values.

18. The system of claim 17 , wherein

the mapping file indicates one or more keys in the structured or semi-structured document mapped to one or more search fields in the DSL query, and

the one or more values represent the one or more keys in the structured or semi-structured document.

19. The system of claim 18 , wherein the program instructions are executable to:

parse the DSL query into the one or more comparison statements;

for each comparison statement,

access the mapping file;

identify a key of the one or more keys in the structured or semi-structured document utilizing a search field of the one or more search fields;

parse the structured or semi-structured document;

extract an associated value of the key utilizing the key in the structured or semi-structured document; and

parse the value or converting the value to an expected data type indicated in the metadata file;

compare the associated value with a value specified in the DSL query;

determine whether the structured or semi-structured document matches the DSL query;

determine whether the DSL query comprises a plurality of comparison statements; and

repeat the comparing for each comparison statement of the plurality of comparison statements if the DSL query comprises the plurality of comparison statements.

20. The system of claim 16 , wherein

the search request comprises a hypertext transfer protocol (HTTP) request,

the distributed search cluster is implemented by a search server,

the structured or semi-structured document is a JavaScript Object Notation (JSON) document, and

the JSON document represents a security event that identifies a security vulnerability associated with a computing device communicatively coupled to the security server.