We are excited to announce the general availability of Imply 3.3 which greatly expands the expressivity of SQL by adding the ability to do JOINs and interact with lookups in novel ways.
This release includes over 200 new features, performance enhancements, bug fixes, and major documentation improvements.
We are thrilled to release Druid’s most requested query side feature: JOINs. Druid supports INNER, LEFT, and CROSS joins for now. It is now possible to express Druid’s lookups as a JOIN.
It is now also possible to query lookups directly through SQL enabling you to easily introspect and filter them.
Alerts will also be made available in Imply Clarity, allowing you to set up alerting for the health of your Druid cluster. These alerts could proactively notify you via email or a webhook integration (such as PagerDuty) about any issues in your cluster according to your own SLAs and limits.
Pivot roles can now be connected to Druid users allowing you to have end-to-end access control between Pivot and in Druid. In particular it allows you to create Pivot users that can create data cubes in Pivot but are limited to a selection of datasources in Druid.
This release gives you more tools around restricting exactly what data permissions are used to pull the Alerts and Scheduled reports. Specifically every Alert and Report now belongs to a single user “owner”, the “Owner” of the alert is the user whose permissions and data access will be used to query the data. This makes it simple to verify that every alert and scheduled report is run within its possible permission.
Agents don’t query like your detections do
A security team of four has run a major SIEM since February. Nobody on the team writes SPL. Nobody opens the console or looks at the dashboards. Every question goes through an AI agent, which writes the query,...
Learn MoreWhy You Shouldn’t Have to Delete Your VPC Flow Logs
When a security incident happens, investigators almost always start with the same questions: Which systems communicated? Where did the traffic originate? What changed before the incident? Was data exfiltrated?...
Learn MoreSplunk Smartstore vs Lumi Loglake: Two Very Different Ways to Search Logs in Object Storage
One copies data back before it can be searched. The other queries it where it lives. Lumi Loglake lets Splunk teams query logs directly in object storage, including AWS S3, Delta Lake, Apache Iceberg, using...
Learn More
Vadim Ogievetsky