Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Sichere ProgrammierungWhat is Programming And How i can Enjoy it?(24.09.2026 um 11:54 Uhr)
Sichere ProgrammierungYou Don't Need Adobe Commerce Cloud to Survive Black Friday(24.09.2026 um 11:55 Uhr)
Malware / Trojaner / VirenBeyond Lazarus: Organization of DPRK cyber capabilities(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenBeyond Lazarus: Organization of DPRK Cyber Capabilities(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenThe fake worker threat and the rise of human infiltration(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenPolinRider Spreads Through Compromised GitHub Accounts and Packagist(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenWeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials(24.09.2026 um 11:59 Uhr)
Sichere ProgrammierungWhat is Programming And How i can Enjoy it?(24.09.2026 um 11:54 Uhr)
Sichere ProgrammierungYou Don't Need Adobe Commerce Cloud to Survive Black Friday(24.09.2026 um 11:55 Uhr)
Malware / Trojaner / VirenBeyond Lazarus: Organization of DPRK cyber capabilities(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenBeyond Lazarus: Organization of DPRK Cyber Capabilities(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenThe fake worker threat and the rise of human infiltration(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenPolinRider Spreads Through Compromised GitHub Accounts and Packagist(24.09.2026 um 11:59 Uhr)
Malware / Trojaner / VirenWeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials(24.09.2026 um 11:59 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

Part 2: BigQuery Deep Dive 🔍

What is BigQuery? BigQuery is Google's data warehouse in the cloud. It's one of the most popular choices for storing and analyzing large amounts of data because it's: Serverless - You don't manage any servers. No installing software,…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




What is BigQuery?



BigQuery is Google's data warehouse in the cloud. It's one of the most popular choices for storing and analyzing large amounts of data because it's:




  1. Serverless - You don't manage any servers. No installing software, no worrying about disk space, no maintenance. Google handles everything.


  2. Fully managed - Google takes care of security, backups, scaling, and updates.


  3. Petabyte-scale - Can handle absolutely massive datasets (1 petabyte = 1,000 terabytes = 1,000,000 gigabytes!)


  4. SQL-based - You just write SQL queries. No need to learn a new programming language!







Why BigQuery is Great for Beginners 🌟




  • ☁️ No setup headaches - Create a project, load data, start querying. That's it!

  • 💰 Free tier - 1TB of queries and 10GB storage free per month

  • 📊 Familiar SQL - If you know basic SQL, you can use BigQuery

  • 🔗 Works with everything - Google Sheets, Data Studio, Python, R, etc.

  • 🤖 Built-in ML - Train machine learning models using just SQL!






How BigQuery Works Under the Hood 🔧



Understanding the architecture helps you write better queries and save money. Don't worry, I'll keep it simple!






The Secret: Separation of Storage and Compute



Traditional databases store data and process queries on the same machine. BigQuery does something clever - it separates them:




┌─────────────────────────────────────────────────────────┐
│ YOUR SQL QUERY │
└─────────────────────────┬───────────────────────────────┘


┌─────────────────────────────────────────────────────────┐
│ DREMEL (Compute Engine) │
│ │
│ Your query gets broken into tiny pieces and │
│ thousands of workers process them in parallel │
└─────────────────────────┬───────────────────────────────┘

│ Jupiter Network (super fast!)
│ 1 Terabyte per second


┌─────────────────────────────────────────────────────────┐
│ COLOSSUS (Storage) │
│ │
│ Your data lives here in COLUMNAR format │
│ (organized by columns, not rows) │
└─────────────────────────────────────────────────────────┘









What Does "Columnar Storage" Mean? 📋



This is SUPER important for understanding BigQuery performance!



Traditional databases (row-oriented):

Stores data like this:




Row 1: [John, 25, New York, $50000]
Row 2: [Jane, 30, Chicago, $60000]
Row 3: [Bob, 35, Miami, $55000]






To find all salaries, it reads EVERY row, even though you only need one column.



BigQuery (column-oriented):

Stores data like this:




Names column:    [John, Jane, Bob]
Ages column: [25, 30, 35]
Cities column: [New York, Chicago, Miami]
Salaries column: [$50000, $60000, $55000]






To find all salaries, it ONLY reads the salary column! Much faster and cheaper!



💡 This is why SELECT * is expensive in BigQuery - it has to read EVERY column. Always specify only the columns you need!






The Dremel Execution Engine 🚀



When you run a query, here's what happens:





  1. Root Server receives your query

  2. Query is broken into smaller pieces


  3. Mixers distribute work to thousands of Leaf Nodes

  4. Each Leaf Node processes a small chunk of data in parallel

  5. Results flow back up through Mixers to Root

  6. You get your final result!




                    ┌──────────┐
│ ROOT │ ← Your query comes here
└────┬─────┘

┌─────────────┼─────────────┐
▼ ▼ ▼
┌────────┐ ┌────────┐ ┌────────┐
│ MIXER │ │ MIXER │ │ MIXER │
└───┬────┘ └───┬────┘ └───┬────┘
│ │ │
┌─────┼─────┐ ┌─────┼─────┐ ┌─────┼─────┐
▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
[L] [L] [L][L] [L] [L][L] [L] [L]

L = Leaf nodes (thousands of them!)






Why this matters: A query that would take hours on your laptop can run in seconds because thousands of machines work on it simultaneously!






External Tables vs Native Tables 📦



You have two ways to work with data in BigQuery:






Option 1: External Tables (Data stays in GCS)



Your data remains in Google Cloud Storage, BigQuery just reads it when you query.




-- Create external table pointing to files in GCS bucket
CREATE OR REPLACE EXTERNAL TABLE `my-project.my_dataset.taxi_external`
OPTIONS (
format = 'PARQUET',
uris = ['gs://my-bucket/taxi_data/*.parquet']
);






When to use External Tables:




  • ✅ You want to save on storage costs (GCS is cheaper than BigQuery storage)

  • ✅ One-time or occasional analysis

  • ✅ Data is updated frequently in source system

  • ✅ Quick exploration before committing to load



Downsides:




  • ❌ Slower queries (data needs to be read from GCS each time)

  • ❌ No cost estimation before running queries

  • ❌ Can't partition or cluster (limited optimization)






Option 2: Native Tables (Data loaded into BigQuery)



Data is copied into BigQuery's own storage (Colossus).




-- Create native table from external table
CREATE OR REPLACE TABLE `my-project.my_dataset.taxi_native` AS
SELECT * FROM `my-project.my_dataset.taxi_external`;






When to use Native Tables:




  • ✅ Frequently queried data

  • ✅ Need best query performance

  • ✅ Want to use partitioning and clustering

  • ✅ Need accurate cost estimates before running queries



Downsides:




  • ❌ Higher storage costs

  • ❌ Data duplication (exists in both GCS and BigQuery)



💡 Pro tip: Start with external tables for exploration, then load into native tables once you know what data you actually need!






Understanding BigQuery Costs 💰



BigQuery has two main pricing models:






On-Demand Pricing (Pay per query)





  • $5 per TB of data scanned

  • Good for: Occasional users, unpredictable workloads

  • You pay for how much data your queries read






Flat-Rate Pricing (Monthly commitment)





  • ~$2,000/month for 100 "slots" (compute units)

  • Good for: Heavy users, predictable workloads

  • Unlimited queries within your slot capacity






How to Estimate Query Cost 🧮



Before running a query, BigQuery shows you how much data it will scan:




┌────────────────────────────────────────────────┐
│ Query Editor │
│ ─────────────────────────────────────────────│
│ SELECT * FROM my_table WHERE date = '2024-01'│
│ │
│ [This query will process 2.5 GB when run] │ ← Check this!
└────────────────────────────────────────────────┘






Cost calculation:




  • 2.5 GB = 0.0025 TB

  • 0.0025 TB × $5 = $0.0125 (about 1 cent)



But if you run that query 100 times a day... costs add up!






Cost Optimization Tips 💡





  1. NEVER use SELECT * unless you absolutely need every column




   -- ❌ Bad - reads ALL columns
SELECT * FROM taxi_data;

-- ✅ Good - reads only what you need
SELECT pickup_time, dropoff_time, fare_amount FROM taxi_data;







  1. Use partitioned tables (covered in Part 3)


  2. Preview before running - Always check the estimated bytes


  3. Use LIMIT wisely - It doesn't reduce data scanned! The filtering happens AFTER reading.





   -- ❌ Still scans the whole table!
SELECT * FROM huge_table LIMIT 10;

-- ✅ Better - add a WHERE clause first
SELECT * FROM huge_table WHERE date = CURRENT_DATE() LIMIT 10;








  1. Cache results - BigQuery caches query results for 24 hours (free!)






BigQuery Caching 🗄️



When you run the same query twice:




  • First run: Scans data, costs money

  • Second run: Returns cached result, FREE!



Cache is invalidated when:




  • Underlying table data changes

  • 24 hours pass

  • You disable caching in query settings









DataEngineeringZoomcamp #BigQuery #DataWarehouse #GCP #SQL #CloudComputing

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - Part 2: BigQuery Deep Dive 🔍
id: 2b66247a-9254-4115-bd79-257a84ccc20b
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Part 2: BigQuery Deep Dive 🔍" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Part 2: BigQuery Deep Dive 🔍.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Part 2: BigQuery Deep Dive 🔍

Thematisch verwandte Begriffe: Part, BigQuery, Deep, Dive · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY Kritische Sicherheitsmeldung
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick