Keep the original evidence
Retain requests and responses in VARIANT while Streams and Tasks populate typed columns for frequent searches.
DATABEND SOLUTIONS · INDUSTRY
Cybersecurity
Investigate threats with evidence, not raw log dumps
Connect API activity with approvals, deployments, and credential use. Build risk baselines in SQL and let agents investigate through scoped, read-only access.
From API logs to a bounded investigation
Preserve raw JSON, extract typed events, and build ten-minute features. A Dynamic Table combines context and a 30-day baseline before agents drill into timelines and raw evidence.
Scroll horizontally to explore the full diagram.
Score behavior in context
Correlate sensitive calls with approvals, deployment history, and credential activity instead of relying on volume thresholds alone.
Bound every investigation
Use an independent warehouse and SELECT-only role. Narrow the risk, query a time-bounded timeline, then retrieve JSON by log_id.
Explore the details
Start with one security investigation
Validate the workflow with your own logs and security context.
