Chaining of domain specific language-based queries

A component, comprising:

• one or more memories;
• and
• one or more processors communicatively coupled to the one or more memories, the one or more processors, either alone or in combination, configured to:
• generate a domain-specific language (DSL) query comprising an ordered set of data source-specific queries that comprises a set of chained data source-specific queries,
• wherein the set of chained data source-specific queries comprises a first data source-specific query and a second data source-specific query that is configured to be executed after the first data source-specific query, with the second data source-specific query being chained to the first data source-specific query via a first field of the second data source-specific query that is linked to a first intermediate result of the first data source-specific query;
• execute the DSL query to derive a set of results comprising a DSL query result associated with the set of chained data source-specific queries, and a set of intermediate results associated with the set of chained data source-specific queries;
• report information associated with the set of results;
• and
• scan the set of results to detect an attack chain stage associated with an intrusion.

A non-transitory computer-readable medium storing computer-executable instructions that, when executed by a component, cause the component to:

• generate a domain-specific language (DSL) query comprising an ordered set of data source-specific queries that comprises a set of chained data source-specific queries,
• wherein the set of chained data source-specific queries comprises a first data source-specific query and a second data source-specific query that is configured to be executed after the first data source-specific query, with the second data source-specific query being chained to the first data source-specific query via a first field of the second data source-specific query that is linked to a first intermediate result of the first data source-specific query;
• execute the DSL query to derive a set of results comprising a DSL query result associated with the set of chained data source-specific queries, and a set of intermediate results associated with the set of chained data source-specific queries;
• report information associated with the set of results;
• and
• scan the set of results to detect an attack chain stage associated with an intrusion.