Standing query creation using store query

A method for converting a store query into a standing query, the standing query being configured to facilitate an improvement in computer security by identifying computer security threats upstream from a database, the method comprising:

• accessing a store query that is structured in accordance with a store query language, wherein the store query is configured to query a database that stores events received from a data stream, and the store query is verified as being known to return results that potentially correspond to security threats when queried against the events after the events are stored in the database;
• creating a syntax graph of the store query;
• accessing a set of rules of the store query language of the store query;
• using at least the syntax graph and the set of rules of the store query language to convert the store query into a standing query;
• deploying a first instance of the standing query into a first intermediary computing system and deploy a second instance of the standing query into a second intermediary computing system, wherein:
• the first intermediary computing system is situated between a first event source and the database, and the second intermediary computing system is situated between a second event source and the database;
• the first intermediary computing system is configured to gather new events originating from the first event source, and the second intermediary computing system is configured to gather new events originating from the second event source;
• a plurality of nodes are involved in uploading said new events to the data stream, and each node in the plurality of nodes bookmarks which new events the first intermediary computing system and/or the second intermediary system has received;
• the first intermediary system is further configured to receive events from the first event source using a transmission control protocol (TCP) such that the first instance of the standing query operates on TCP-based events;
• and
• the second intermediary system is configured to receive events from the second event source using a user datagram protocol (UDP) such that the second instance of the standing query operates on UDP-based events;
• and
• executing the first instance of the standing query and the second instance of the standing query against the new events that are uploaded in the data stream and that originate from the first and the second event sources, wherein the standing query, including any instances thereof, is configured to identify specific events that correspond to potential computer security threats and to generate alerts for the specific events.

One or more computer-readable hardware storage devices comprising physical memory that store computer executable instructions that are executable by one or more processors of a computing system to at least:

• access a store query that is structured in accordance with a store query language, wherein the store query is configured to query a database that stores events received from a data stream, and the store query is verified as being known to return results that potentially correspond to security threats when queried against the events after the events are stored in the database;
• create a syntax graph of the store query;
• access a set of rules of the store query language of the store query;
• use at least the syntax graph and the set of rules of the store query language to convert the store query into a standing query;
• deploy a first instance of the standing query into a first intermediary computing system and deploy a second instance of the standing query into a second intermediary computing system, wherein:
• the first intermediary computing system is situated between a first event source and the database, and the second intermediary computing system is situated between a second event source and the database;
• the first intermediary computing system is configured to gather new events originating from the first event source, and the second intermediary computing system is configured to gather new events originating from the second event source;
• a plurality of nodes are involved in uploading said new events to the data stream, and each node in the plurality of nodes bookmarks which new events the first intermediary computing system and/or the second intermediary system has received;
• the first intermediary system is further configured to receive events from the first event source using a transmission control protocol (TCP) such that the first instance of the standing query operates on TCP-based events;
• and
• the second intermediary system is configured to receive events from the second event source using a user datagram protocol (UDP) such that the second instance of the standing query operates on UDP-based events;
• and
• execute the first instance of the standing query and the second instance of the standing query against the new events that are uploaded in the data stream and that originate from the first and the second event sources, wherein the standing query, including any instances thereof, is configured to identify specific events that correspond to potential computer security threats and to generate alerts for the specific events.