Security Analytics Without SIEM Costs

-- Detect brute force login attempts
CREATE PIPELINE brute_force_detection AS
SELECT
  source_ip,
  target_user,
  window_start,
  COUNT(*) as failed_attempts
FROM TABLE(
  TUMBLE(
    TABLE auth_events,
    DESCRIPTOR(event_time),
    INTERVAL '5' MINUTE
  )
)
WHERE event_type = 'LOGIN_FAILED'
GROUP BY source_ip, target_user, window_start, window_end
HAVING COUNT(*) > 10
INTO iceberg.security.brute_force_alerts;

-- Correlate network and endpoint events
CREATE PIPELINE lateral_movement AS
SELECT
  n.source_ip,
  n.dest_ip,
  e.process_name,
  e.user_name,
  n.event_time
FROM network_events n
JOIN endpoint_events e
  ON n.dest_ip = e.host_ip
  AND e.event_time BETWEEN n.event_time AND n.event_time + INTERVAL '30' SECOND
WHERE n.dest_port IN (445, 3389, 22)
  AND e.event_type = 'PROCESS_START'
INTO iceberg.security.lateral_movement_alerts;