Multilayer query filtering logic transformations
Various embodiments include systems and methods to implement a security platform providing query transformations and layered filtering. Security data associated with a client deployment of assets may be determined and analyzed for identifying security vulnerabilities. The security platform may support an application programming interface that provides a flexible query format that allows multiple layers of filtering logic at various layers of a frontend query. The filtering logic may be translated into a backend query format used to retrieve security data specified by the frontend query.
1 . A method comprising:
receiving a frontend query that requests security data associated with assets in a network;
parsing, in accordance with a first format, the frontend query to determine a plurality of layers of attribute specifications;
determining, based on the parsing of the frontend query and with respect to a first layer of the plurality of layers of attribute specifications, first filtering logic comprising a first one or more fields and a first one or more logical operators;
determining, based on the parsing of the frontend query and with respect to a second layer of the plurality of layers of attribute specifications, second filtering logic comprising a second one or more fields and a second one or more logical operators;
generating, based at least on the first filtering logic and on the second filtering logic, a backend query for a database in accordance with a second format, including:
identifying, based on the first filtering logic, one or more first statements in a template;
generating, based on the one or more first statements and the template, a first query clause of the backend query, wherein the first query clause transforms the first one or more fields of the into one or more locations in a schema of the database;
identifying, based on the second filtering logic, one or more second statements in the template; and
generating, based on the one or more second statements and the template, a second query clause of the backend query, wherein the second query clause transforms the second one or more logical operators of the frontend query into one or more logical operators in a syntax of the second format; and
executing the backend query on the database to determine a result dataset, wherein the result dataset includes security data about one or more assets in the network that satisfies the frontend query without comprising data that does not satisfy the frontend query.
2 . The method of claim 1 , wherein the generating of the backend query further comprises: transforming a sorting or paging parameter in the frontend query according to the second format.
3 . The method of claim 1 , wherein the identifying of the one or more first statements in the template comprises matching the first filtering logic to one or more portions of code used to generate the first query clause.
4 . The method of claim 1 , wherein:
the database is implemented as part of a security platform that monitors the network; and
the security data includes network activity data or network event data of the network collected by agents deployed in the network.
5 . The method of claim 1 , wherein the first format is associated with an application programming interface.
6 . The method of claim 1 , wherein the second format is associated with a database storing the set of structured data.
7 . The method of claim 6 , wherein a respective attribute of the plurality of layers of attributes is associated with a respective column of a table within the database.
8 . A system comprising:
a memory storing executable instructions; and
one or more processors that execute the executable instructions to:
receive a frontend query that requests security data associated with assets in a network;
parse, in accordance with a first format, the frontend query comprising a plurality of layers of attribute specifications;
determine, based on the parsing of the frontend query and with respect to a first layer of the plurality of layers of attribute specifications, first filtering logic comprising a first one or more fields and a first one or more logical operators;
determine, based on the parsing of the frontend query and with respect to a second layer of the plurality of layers of attribute specifications, second filtering logic comprising a second one or more fields and a second one or more logical operators;
generate, based at least on the first filtering logic and on the second filtering logic, a backend query for a database in accordance with a second format, including to:
identify, based on the first filtering logic, one or more first statements in a template;
generate, based on the one or more first statements and the template, a first query clause of the backend query, wherein the first query clause transforms the first one or more fields of the into one or more locations in a schema of the database;
identify, based on the second filtering logic, one or more second statements in the template; and
generate, based on the one or more second statements and the template, a second query clause of the backend query, wherein the second query clause transforms the second one or more logical operators of the frontend query into one or more logical operators in a syntax of the second format; and
execute the backend query on the database to determine a result dataset, wherein the result dataset includes security data about one or more assets in the network that satisfies the frontend query without comprising data that does not satisfy the frontend query.
9 . The system of claim 8 , wherein to generate the backend query, the one or more processors that execute the executable instructions to transform a sorting or paging parameter in the frontend query according to the second format.
10 . The system of claim 8 , wherein to identify the one or more first statements in the template, the one or more processors that execute the executable instructions to match the first filtering logic to one or more portions of code used to generate the first query clause.
11 . The system of claim 8 , wherein:
the database is implemented as part of a security platform that monitors the network; and
the security data includes network activity data or network event data of the network collected by agents deployed in the network.
12 . The system of claim 8 , wherein the first format is associated with an application programming interface.
13 . The system of claim 8 , wherein the second format is associated with a database storing the set of structured data.
14 . The system of claim 8 , wherein a respective attribute of the plurality of layers of attributes is associated with a respective column of a table within the database.
15 . One or more non-transitory computer-accessible storage media storing executable instructions that, when executed by one or more processors, cause a computer system to:
receive a frontend query that requests security data associated with assets in a network;
parse, in accordance with a first format, the frontend query comprising a plurality of layers of attribute specifications;
determine, based on the parsing of the frontend query and with respect to a first layer of the plurality of layers of attribute specifications, first filtering logic comprising a first one or more fields and a first one or more logical operators;
determine, based on the parsing of the frontend query and with respect to a second layer of the plurality of layers of attribute specifications, second filtering logic comprising a second one or more fields and a second one or more logical operators;
generate, based at least on the first filtering logic and on the second filtering logic, a backend query for a database in accordance with a second format, including to:
identify, based on the first filtering logic, one or more first statements in a template;
generate, based on the one or more first statements and the template, a first query clause of the backend query, wherein the first query clause transforms the first one or more fields of the into one or more locations in a schema of the database;
identify, based on the second filtering logic, one or more second statements in the template; and
generate, based on the one or more second statements and the template, a second query clause of the backend query, wherein the second query clause transforms the second one or more logical operators of the frontend query into one or more logical operators in a syntax of the second format; and
execute the backend query on the database to determine a result dataset, wherein the result dataset includes security data about one or more assets in the network that satisfies the frontend query without comprising data that does not satisfy the frontend query.
16 . The non-transitory computer-accessible storage media of claim 15 , wherein to generate the backend query, the executable instructions when executed by the one or more processors further cause a computer system to transform a sorting or paging parameter in the frontend query according to the second format.
17 . The non-transitory computer-accessible storage media of claim 15 , wherein to identify the one or more first statements in the template, the executable instructions when executed by the one or more processors cause a computer system to match the first filtering logic to one or more portions of code used to generate the first query clause.
18 . The non-transitory computer-accessible storage media of claim 15 , wherein:
the database is implemented as part of a security platform that monitors the network; and
the security data includes network activity data or network event data of the network collected by agents deployed in the network.
19 . The non-transitory computer-accessible storage media of claim 15 , wherein the first format is associated with an application programming interface.
20 . The non-transitory computer-accessible storage media of claim 19 , wherein the second format is associated with a database storing the set of structured data.