Support for a new insert stream (ISTREAM) operation in complex event processing (CEP)

A non-transitory computer-readable storage memory having stored thereon instructions for causing at least one computer system to detect policy violations for an organization, the instructions comprising:

• instructions that cause the at least one computer system to initialize a stream of data for a continuous query logic (CQL) operation;
• instructions that cause the at least one computer system to identify at least one column of interest within the stream of data, the at least one column of interest to be monitored for changes to data that occur within the at least one column of interest over a time interval;
• instructions that cause the at least one computer system to select, by a relation-to-stream operator, the at least one column of interest by applying the relation-to-stream operator to a SELECT list expression to select a subset of the stream of data over the time interval, the SELECT list expression comprising a parameter of the relation-to-stream operator;
• instructions that cause the at least one computer system to monitor, by the relation-to-stream operator, changes to the data that occur within the at least one column of interest over the time interval;
• instructions that cause the at least one computer system to determine, by the relation-to-stream operator, that at least one value from the at least one column of interest has changed based at least in part on applying a clause associated with the relation-to-stream operator on the column of interest, the clause detecting that the at least one value in the at least one column of interest has changed within the time interval;
• and
• in response to determining that the at least one value of the at least one column of interest has changed, instructions that cause the at least one computer system to output the at least one value that has changed in the at least one column of interest that occurs within the time interval using the CQL operation.

A system for processing streaming data, comprising:

• one or more computing devices comprising at least one processor configured to execute computer executable instructions to collectively at least:
• initialize a stream of data for a continuous query logic (CQL) operation;
• identify at least one column of interest within the stream of data, the at least one column of interest to be monitored for changes to data that occur within the at least one column of interest over a time interval;
• select, by a relation-to-stream operator, the at least one column of interest by applying the relation-to-stream operator to a SELECT list expression to select a subset of the stream of data over the time interval, the relation-to-stream operator identifying a function comprising the SELECT list expression;
• monitor, by the relation-to-stream operator, changes to the data that occur within the at least one column of interest over the time interval;
• determine, by the relation-to-stream operator, that at least one value from the at least one column of interest has changed based at least in part on applying a clause associated with the relation-to-stream operator on the column of interest, the clause detecting that the at least one value in the at least one column of interest has changed within the time interval;
• in response to determining that the at least one value of the at least one column of interest has changed, outputting the at least one value that has changed in the at least one column of interest that occurs within the time interval using the CQL operation;
• determine that no values from the at least one column of interest have changed over the time interval;
• and
• in response to determining that no values from the at least one column of interest have changed, not outputting the values from the at least one column of interest.