First off - some numbers
… First off - some numbers. We're a near real-time cybersecurity platform, and we ingest tens of billions of raw events daily from thousands of different endpoints across SaaS. Additionally, a significant subset of our customers are quite large (think Fortune 500 and up). For the engine, that means a few things: - It was designed to be dynamic by nature, so that both out-of-the-box and user-defined expressions evaluate seamlessly. - Schemas vary wildly, of which there are thousands, since they are received from external sources. Often with little documentation. - A matching expression needs to be alerted on immediately, as these are critical to business safety (no use triggering an alert on a breached account a day later). - Endpoints change and break on a near-weekly basis, so being able to update expressions on the fly is integral to the process, and should not require changes by the dev team. Now to answer some questions: - Why JSONata: others have mentioned it here, but it is a fantastic and expressive framework with a very detailed spec. …
Original discussionWe Rewrote JSONata with AI in a Day, Saved $500K/Year256 source comments · at import