Back homeIndustry

Cybersecurity & threat detection

Keep every security event, know the state of every entity right now, and run detections as queries that stay open.

The problem

Where the usual stack breaks

01
Security telemetry never stops: authentication events, network flows, endpoint signals and audit records arrive from every system you run, and the questions that matter are about the last few seconds. Which account just changed behaviour, which host is talking to a new destination, which key was used from two places at once.
02
The usual answer spreads one investigation across a log store for history, a stream processor for rules, a cache for entity state and a ticketing tool for the trail. Each hand-off adds delay, and every copy is a place where the state an analyst reads disagrees with the state that raised the alert.
03
The fit is one engine that keeps the raw events durable, maintains per-entity state from them, evaluates detections continuously over the same writes, and lets you reread any table exactly as it was when a decision was made.

Where NYXDB fits

Use-case journeys

Account and fraud signals

Per-entity risk state maintained live and versioned for review.

Fraud & risk

Log analytics and SIEM feeds

Raw events rolled up into live metric tables and followed as they move.

Observability & logs

Windowed detection rules

Rate and burst detections as queries over tumbling or hopping windows.

Time-series & monitoring

Architecture

How NYXDB fits security operations

Events append in full; transformations fold them into per-entity risk and activity state; STREAM SELECT runs detections over windows and pushes hits to responders; VERSIONED tables answer AS OF COMMIT reads for forensics.

01
Ingest
Authentication, flow and endpoint events append through SQL, write batches or native bulk frames.
02
Entity state
Transformations keep per-user, per-host and per-key counters and last-seen state in keyed tables.
03
Detect
STREAM SELECT over TUMBLE or HOP windows evaluates burst, novelty and threshold rules as events arrive.
04
Investigate
VERSIONED tables keep every accepted version; AS OF COMMIT reads the state exactly as it was at the alert.

In practice

Representative statements

A burst detector — a windowed continuous query

STREAM SELECT window_start, window_end, sender, COUNT() AS transfers
FROM HOP(transfers, transferred_at, INTERVAL 10 SECONDS, INTERVAL 1 MINUTE)
GROUP BY window_start, window_end, sender
EMIT AFTER WINDOW CLOSE;

Forensics — the state exactly as it was at the alert

SELECT address, token, amount
FROM balances AS OF COMMIT 42
WHERE chain_id = 1;

The examples use the same two tables on every page. See the SQL reference for full syntax.

Capabilities

What you get out of the box

Complete event history

Every event kept as written, in one durable table.

Live entity state

Per-user, per-host and per-key state maintained from every event.

Detections as queries

TUMBLE / HOP / SESSION windows in STREAM SELECT, pushed as they fire.

Point-in-time forensics

AS OF COMMIT reads a table exactly as it was at the alert.

Learn more

Streaming

Windows and EMIT.

Versioned tables

History and AS OF COMMIT.

Users & keys

Credentials and API keys in SQL.

Detections that read the same state you store

Explore the fraud and observability solutions, or run a node.

Get startedRead the docs