Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Videos & KonferenzenTwo Minute Papers: Claude Opus 5.5 AI: A Massive Leap Forward(24.09.2026 um 10:40 Uhr)
Sicherheitslücken (CVE)USN-8805-1: Moodle vulnerability(23.09.2026 um 16:43 Uhr)
Sichere ProgrammierungI thought clipboard sync would be simple. Android had other plans.(24.09.2026 um 11:01 Uhr)
Sichere ProgrammierungAI-assisted genealogy, a follow-up(24.09.2026 um 11:02 Uhr)
Sicherheitslücken (CVE)Smart Contract Vulnerability Surface Analysis: HashKey Exchange(24.09.2026 um 11:02 Uhr)
Sichere ProgrammierungAI Agents Calling Your Existing Backend Without MCP Development(24.09.2026 um 11:06 Uhr)
Videos & KonferenzenTwo Minute Papers: Claude Opus 5.5 AI: A Massive Leap Forward(24.09.2026 um 10:40 Uhr)
Sicherheitslücken (CVE)USN-8805-1: Moodle vulnerability(23.09.2026 um 16:43 Uhr)
Sichere ProgrammierungI thought clipboard sync would be simple. Android had other plans.(24.09.2026 um 11:01 Uhr)
Sichere ProgrammierungAI-assisted genealogy, a follow-up(24.09.2026 um 11:02 Uhr)
Sicherheitslücken (CVE)Smart Contract Vulnerability Surface Analysis: HashKey Exchange(24.09.2026 um 11:02 Uhr)
Sichere ProgrammierungAI Agents Calling Your Existing Backend Without MCP Development(24.09.2026 um 11:06 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

Building a conversational AI tool for real-time analytics

Tinybird just announced Explorations, a new conversational UI feature in Tinybird to explore and interact with your data using natural language. Instead of writing complex SQL queries or manually building dashboards, you just ask questions…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Tinybird just announced Explorations, a new conversational UI feature in Tinybird to explore and interact with your data using natural language. Instead of writing complex SQL queries or manually building dashboards, you just ask questions of your data and get answers.






How does it work?




  • You type simple, natural-language questions directly into the interface.

  • It translates your questions into contextualized SQL queries automatically.

  • The result is displayed visually as tables and charts.










Why is it useful?



Data is often large, messy, and unstructured. You have to spend a lot of time studying the schema or SELECT * … LIMIT 1 to figure out its shape. Then you have to constantly check the SQL reference and iterate your queries to get things right. When data is complex, this is a huge time drain.



Explorations…




  • Removes the barrier to understanding your data. Anyone can explore complex tables with natural language instead of writing complicated queries.

  • Speeds up the analytics workflows significantly by getting you to a functional query much faster.

  • Combines classic Tinybird data exploration interfaces ("Playgrounds" and "Time-series") into a unified, streamlined UI.






Tech stack



Under the hood, Explorations is powered by the following technologies:





  • Next.js with App Route Handlers: We leverage Next.js app routes to stream responses incrementally. This eliminates wait time because parts of the data become immediately visible as they're retrieved.


  • Vercel AI SDK: We use the Vercel AI SDK to simplify how we handle chat state. The AI SDK allows us to subscribe easily to ongoing data streaming, ensuring a synchronized experience between client and server.


  • Vertex AI: Vertex AI simplifies model selection, allowing us to easily switch between different models and providers and choose the best one for the job. It also helps us define fallback models with similar quality in case the primary model is unavailable for some reason.








Dealing with LLMs



Despite how common AI chatbots are, developing this conversational AI interface was not a straightforward process, requiring several iterations to overcome some unique challenges we faced.






Tool definition



An LLM needs access to many different operations to explore data in Tinybird:




  • Retrieving relevant resources (data sources, pipes, etc.) given a prompt

  • Sending queries to our SQL API to understand how the data looks

  • Creating SQL nodes

  • Generating timeseries visualizations

  • And many other smaller things (for example, creating a relevant title for the exploration)



Completing an exploration task requires careful execution of these operations in a specific order. The first LLM call acts as an orchestration layer. It has access to all these tools, and it is in charge of deciding which ones to use depending on the user's request.



Allowing LLMs to use external systems is called function calling. To help decide the correct tool for the job, the system prompt explains the UX and the requirements for accessing each available tool. Here is a truncated view of the system prompt:




Explorations is a web interface that helps users to explore data in Tinybird. When an exploration is open, the user will have a list of nodes on the right side of the screen, while the conversation in markdown format is on the left side.When creating or updating nodes, changes are reflected in real-time on the nodes and visible to the user.
This is a guide for using the explorations tools:
**When to use \`executeQuery\`:**
- Run ALWAYS before generating a node to understand the data of the resources involved in the query
...
**When to use \`createNode\`:**
- When executeQuery has been run previously and you understand the data to build the final query
...
**When not to use \`createNode\`:**
- If data has been not queried previously
...









LLM chaining



Depending on the complexity of the task proposed by a user, a single LLM request may not be enough, so in some cases, we need to run multiple LLM calls to build upon each other's work. This technique is called LLM chaining.



Under the hood, we reuse the data stream generated for the initial LLM call, so the user receives feedback immediately on what is happening.




function timeSeriesTool(dataStream: DataStreamWriter) {
return tool({
description: 'Create a new timeseries node',
parameters: z.object({
name: z.string().describe('The name of the node in lowercase and snake_case format'),
prompt: z
.string()
.describe(
'The user prompt with the changes to create the node'
),
internalPrompt: z
.string()
.describe(
'The internal prompt with explanations about how to create the node sql based on querying the data'
)
}),
execute: async ({ name, prompt, internalPrompt }) => {
dataStream.writeData({
type: 'nodeName',
content: name
})

dataStream.writeData({
type: 'nodeType',
content: 'timeseries'
})

const { fullStream } = streamObject({
model: anthropic(anthropicModel),
system: createTimeSeriesPrompt(internalPrompt),
prompt,
schema: z.object({
sql: z.string(),
xAxisKey: z.string(),
yAxisKey: z.string()
})
})
...









Setting context



Another important part of the Explorations workflow is having rich, structured context so the system has enough information to find the right solution. We manage three types of context:





  • Resource definitions and schemas: We provide the column names and types of every resource in the workspace so the LLM can infer the right data to use.


  • Data context: one of the available tools can execute queries to get a small sample of data and understand how it looks.


  • Workspace rules: Similar to how you can create rules files for Cursor / Windsurf, you can define your own rules to tune the Explorations experience to your specific requirements or use case.






A practical example



We use Tinybird to store and analyze product usage data generated by Tinybird. The data looks something like this:





We might say: "We want to know the actions that did within the product in the last week by day in time series format."



This will trigger a new exploration and the first step in its workflow: the orchestrator layer. The orchestrator has access to all the tools available, and it will use them until the problem is solved.



The first mandatory tool to use in this case is executeQuery. This tool helps the LLM understand the data before proceeding with a final query in an Exploration node. By default, we add all data source schemas to the context, so the tool will know that there is a table called events with these fields: timestamp, event, email, and data. Once it knows the resources it can query, the tool will send requests to Tinybird Query API



If the result is valid, the orchestrator will pass all the info to another tool called createTimeSeriesNode, which generates the final query in timeseries format with the relevant resources and extracts the axis keys to visualize it in a chart. If there is an error in the query result, it will be passed again to the orchestrator LLM to be fixed and tried again. This will continue until the query is valid, and a node can be createdto create the final node. We limit each workflow to 20 tool invocations, so if the orchestrator can't arrive at a valid node query after 20 invocations, the chat will stop. At this point, the user will see a "Fix error" button under the node, which will start a new chat workflow to fix the node query. 



While all this is happening, we render in the chat, via streaming, the reasoning that our AI system is performing. Once the final query is validated, the new node will be generated in Tinybird and rendered in the UI.





The final result will look like this:








Try Explorations



Explorations is making it easier for both new and experienced Tinybird users to understand their data without wasting time formulating complex SQL. To try it out, head to cloud.tinybird.co or run tb open in the CLI, and select Explorations in the left nav.



If you're new to Tinybird, you can sign up for free here.

CTI Threat Relationship Graph3 Knoten / 2 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - Building a conversational AI tool for real-time analytics
id: 22305899-2fa2-4230-b90d-818f24edc712
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Building a conversational AI t" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Building a conversational AI tool for re.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Building a conversational AI tool for real-time analytics

Thematisch verwandte Begriffe: Building, conversational, tool, realtime · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97056 | SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when co…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick