Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
AI & KI NachrichtenCybersicherheit im KI-Zeitalter - Health-ISAC(23.09.2026 um 23:12 Uhr)
IT Security NachrichtenSunrise-CEO: Gewisse Jobs wird es so nicht mehr geben | Nau.ch(23.09.2026 um 23:38 Uhr)
IT Security NachrichtenIT Security News Hourly Summary 2026-09-24 01h : 3 posts(24.09.2026 um 01:00 Uhr)
IT Security NachrichtenPlaceholder domain used in dev docs now serves ClickFix attacks(24.09.2026 um 00:46 Uhr)
IT Security NachrichtenDigitale Identitäten als Dreh- und Angelpunkt - Netzpalaver(23.09.2026 um 21:47 Uhr)
IT Security DownloadsGitHub Release: signalapp/Signal-Desktop v8.29.0-beta.1 (24.09.2026)(24.09.2026 um 00:34 Uhr)
AI & KI NachrichtenCybersicherheit im KI-Zeitalter - Health-ISAC(23.09.2026 um 23:12 Uhr)
IT Security NachrichtenSunrise-CEO: Gewisse Jobs wird es so nicht mehr geben | Nau.ch(23.09.2026 um 23:38 Uhr)
IT Security NachrichtenIT Security News Hourly Summary 2026-09-24 01h : 3 posts(24.09.2026 um 01:00 Uhr)
IT Security NachrichtenPlaceholder domain used in dev docs now serves ClickFix attacks(24.09.2026 um 00:46 Uhr)
IT Security NachrichtenDigitale Identitäten als Dreh- und Angelpunkt - Netzpalaver(23.09.2026 um 21:47 Uhr)
IT Security DownloadsGitHub Release: signalapp/Signal-Desktop v8.29.0-beta.1 (24.09.2026)(24.09.2026 um 00:34 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

I don’t hate SQL. I hate metadata friction.

I don’t struggle with writing SQL, but what I struggle with is everything around it. You know the drill: Open BigQuery console. Write a simple query on top of INFORMATION_SCHEMA. Realize you forgot the partition column. Copy an old q…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

I don’t struggle with writing SQL, but what I struggle with is everything around it. You know the drill:




  1. Open BigQuery console.

  2. Write a simple query on top of INFORMATION_SCHEMA.

  3. Realize you forgot the partition column.

  4. Copy an old query.

  5. Tweak it.

  6. Realize you need another column.

  7. Open docs.

  8. Switch to Airflow to check if you can get the answer faster.

  9. Go back to the BigQuery console.

  10. Forget what you were checking.



None of this is hard. It’s just constant, low-level friction repeated every other day.



So I built something small to reduce that friction.






The problem



I regularly ask questions like:




  • Which tables changed schema recently?

  • What jobs are consuming the most slots?

  • Why was BigQuery slow yesterday?

  • Why are BigQuery costs skyrocketing?



BigQuery exposes many answers through INFORMATION_SCHEMA.



But the queries are rarely trivial. They’re long. They require joins. You need to remember field names. And I constantly find myself going back to the docs for small details.



So I started modeling the metadata in DBT.



I created a few summarized tables for jobs, storage, schema changes, dependencies, and slot usage.



Nothing revolutionary. Just structured the data the way I actually use it. That helped, but I was still writing the same kinds of queries repeatedly.






So I threw an LLM at it



Once I had clean DBT models with decent descriptions, the next step felt obvious.



Instead of writing SQL, what if I just asked questions? Most BI tools advertise Text-to-SQL solutions for business users. Why would it not work for engineers as well?



Here’s what the current setup looks like:




  1. DBT models summarize BigQuery metadata

  2. The data is synced into DuckDB (to avoid scanning BigQuery every time, and because I don't trust the LLMs).

  3. I pass the schema + column descriptions to an LLM.

  4. The LLM generates SQL.

  5. SQL runs against DuckDB



Results are shown in a small terminal UI. That’s it.



TUI console



It’s basically a TUI where I can “chat” with my metadata.






A real example



One week BigQuery was painfully slow. There was likely slot contention. Probably a new transformation was deployed earlier that week.



Instead of digging manually, I tried:




why was bigquery slow this week?




It analyzed slot usage and long-running jobs and identified a new transformation model that was timing out after 6 hours.



I checked with the team responsible. They said they’d fix it.



A few days later, I asked:




Are the slot timeouts gone?




It confirmed that the long-running jobs had disappeared.



That’s when I realized this was actually useful for first-pass investigations.



Analytics mode






It’s not perfect



There were issues immediately.



First, long answers. Even simple questions triggered overly detailed reports. So I split it into two modes: Fast and Analytics.



But the biggest challenge was hallucinations.



BigQuery job IDs are UUID-like strings. Even when the query result was correct, the LLM sometimes invented job IDs in its explanation.



That’s obviously not acceptable.



I tried adding validation steps, but they quickly became too expensive in terms of tokens. Right now, I return raw query results along with summaries.



Expand raw results from queries



I also hit an infinite loop where the LLM queried the data, interpreted it, then queried again, and so on. Luckily, I only had $5 in credits. I added strict usage limits after that.






Why DuckDB?



Mainly cost and speed. I didn’t want to have accidental expensive scans and slow iteration loops.



So I sync the relevant metadata into DuckDB and query that instead.



TUI architecture



It works well at this scale, though obviously you can’t mirror unlimited history.






What this tool actually is



This is not a BI or an observability tool. It’s just a faster way to ask operational questions without writing repetitive metadata queries.



It can be used for:




  • First-level investigations

  • Sanity checks

  • Avoiding copy-paste SQL



That’s it. I use it when I need quick answers.



It doesn’t replace proper analysis. But it lowers the activation energy. And that alone makes it useful.






Open-sourcing?



I’m considering open-sourcing it. Right now, it works with BigQuery metadata, but technically, you could plug in any BigQuery dataset with proper table definitions.



But before I invest more time to support more data engineering ops metadata, I’d love to know:




  • Would you use something like this?

  • Does this solve a real annoyance for you?

  • What would immediately make it unusable?

  • What would make it indispensable?



If there’s interest, I’ll clean up the repo and open-source it.



I’m trying to validate whether this is just my personal itch or something broader.



Honest feedback (including brutal feedback) is welcome.

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
IR-PLAYBOOK-RCE
HIGH
SOC Incident Playbook: Remote Code Execution (RCE) Defense
1-Click Detection Engineering: Sigma & YARA Rules
SOC Ready
title: Detect Exploitation - I don’t hate SQL. I hate metadata friction.
id: ac61f0b3-8ec0-46ad-a917-22c32355e5aa
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "I don’t hate SQL. I hate metad" ascii wide
    condition:
        any of them
}
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten I don’t hate SQL. I hate metadata friction.

Thematisch verwandte Begriffe: dont, hate, metadata, friction · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-96550 | A vulnerability was found in sfturing hosp_order up to 627f426331da8086c…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick