DBDB.io The Encyclopedia of Database Systems · Est. 2017
Database of Databases

Database Entry

Sqrrl


Sqrrl is a graph database management system (DBMS) . It uses secure, adaptable NoSQL built from Apache Accumulo. Originally founded by former employees of the National Security Agency (NSA), Sqrrl focuses on cybersecurity. [03][04][05][06][07][08]

Developer
Country of Origin
US
Start Year
2012
Acquired By
Project Type
Commercial
Written in
Java
Derived From
Accumulo
Operating System
Linux

The main product from Sqrrl is Sqrrl Enterprise, which is a solution for enterprise users on top of Accumulo that can handle massive structured and/or unstructured data sets. A Sqrrl whitepaper describes Sqrrl Enterprise as a threat hunting tool that uses large amounts of data with linked data analysis to aid users going through the 'hunting loop'. In particular, Sqrrl manages data and can display it to users raw or in the form of visualizations for analytics, finding threat patterns, or for further investigation.

Sqrrl has native Hadoop integration and supports multi-structured data.

Database Entry

Sqrrl


Sqrrl is a graph database management system (DBMS) . It uses secure, adaptable NoSQL built from Apache Accumulo. Originally founded by former employees of the National Security Agency (NSA), Sqrrl focuses on cybersecurity.

The main product from Sqrrl is Sqrrl Enterprise, which is a solution for enterprise users on top of Accumulo that can handle massive structured and/or unstructured data sets. A Sqrrl whitepaper describes Sqrrl Enterprise as a threat hunting tool that uses large amounts of data with linked data analysis to aid users going through the 'hunting loop'. In particular, Sqrrl manages data and can display it to users raw or in the form of visualizations for analytics, finding threat patterns, or for further investigation.

Sqrrl has native Hadoop integration and supports multi-structured data.[03][04][05][06][07][08]

History[09][10][11][06][12]


Sqrrl development began in 2011. As a company, it was founded by Ely Kahn and Oren J. Falkowitz who worked in cybersecurity before creating Sqrrl. Sqrrl was built on Apache Accumulo. Customers using Sqrrl came from both the private and public sector.

In January of 2018, Sqrrl was acquired by Amazon Web Services (AWS). Existing users of Sqrrl were able to continue using the software without any changes. In late November 2018, Sqrrl co-founder Ely Kahn (who is now a Security Strategist at AWS) commented on the release of AWS Security Hub, which includes visualizations and security remediation recommendations. However, there were no statements made explicitly about Sqrrl's integration with AWS.

Concurrency Control[13]


Concurrency control is implemented in Sqrrl in a way that is not publicly known. Sqrrl supports concurrency control by doing atomic updates on data entities.

Data Model[13][14][15][16]


After data is ingested, the Sqrrl Enterprise product details each piece at a cell level. Data can be a key/value pair or a field in a JSON document. Sqrrl then uses secondary indexing techniques to store the data in Apache Accumulo in its native form. This flat architecture allows Sqrrl to handle data of different structures.

In 2016, a presentation by Sqrrl stated that the version of Accumulo used by Sqrrl Enterprise stores sorted key-value pairs. The data model itself uses raw events and linked data. Sqrrl is also considered a graph DBMS because it represents data to users in a graphical format and is schema-free. Custom iterators for Accumulo developed by Sqrrl allow users to complete graph analysis on the data.

Indexes[13]


Sqrrl has secondary indexes implemented in a way unknown to the public.

Query Compilation[17]


Sqrrl converts SQL queries into Accumulo iterators.

Query Interface[16]


Sqrrl Enterprise offers users a proprietary query language called SqrrlQL that is integrated with the cell-level security concept. Users are able to execute SQL-like queries (key-value), full-text queries, or graph searches.

Storage Model[13]


System Architecture[16]


With native Hadoop integration, Sqrrl Enterprise ingests data. It is encrypted and labeled, then indexed and stored in Sqrrl's version of Apache Accumulo within the Hortonworks Data Platform (HDP). Sqrrl and HDP, together, store multi-structured data in its native format. This allows users of Sqrrl to make queries of many different kinds.

Citations

18 sources
  1. http://sqrrl.com sqrrl.com Dead — Check Archive
  2. Sqrrl - Wikipedia wikipedia.org
  3. https://sqrrl.com/media/Framework-for-Threat-Hunting-Whitepaper.pdf sqrrl.com Dead — Check Archive
  4. Datafloq: Driving Innovation through Data & Technology datafloq.com
  5. List of Graph Database Management Systems database.guide Dead — Check Archive
  6. https://www.crunchbase.com/organization/sqrrl#section-overview crunchbase.com
  7. https://db-engines.com/en/system/Neo4j;Sphinx;Sqrrl db-engines.com
  8. https://sqrrl.com/blog/ sqrrl.com Dead — Check Archive
  9. New database startup Sqrrl raises $2 million, relocates from D.C. to Cambridge - Innovation Economy - Boston.com boston.com
  10. Research | GigaOm gigaom.com
  11. Announcing AWS Security Hub - YouTube youtube.com
  12. https://twitter.com/ElyKahn twitter.com
  13. Sqrrl System Properties db-engines.com
  14. Secret Sqrrl: NSA “spin-off” company releases data mining tool - Ars Technica arstechnica.com Dead — Check Archive
  15. SQRRL threat hunting platform | PPTX slideshare.net
  16. Latest Insights on Data and AI | Cloudera Blog cloudera.com
  17. The Practical Quant: June 2013 blogspot.com
  18. Amazon's cloud business acquires Sqrrl, a security start-up with NSA roots cnbc.com
Revision #8