What improvements could be made to JupiterOne's query language to simplify complex security investigations?

Introduction

JupiterOne's query language is a critical tool for security investigations, but there's room for improvement to simplify complex queries. I'll analyze the current state, identify pain points, and propose solutions to enhance its usability and effectiveness for security professionals.

Step 1

Clarifying Questions (5 mins)

• Looking at the product context, I'm thinking JupiterOne might be targeting enterprise-level security teams. Could you confirm the primary user base and their typical use cases for the query language?

Why it matters: Determines the complexity level and features we should prioritize Expected answer: Enterprise security teams using it for threat hunting and compliance Impact on approach: Would focus on advanced features and integration capabilities

• Considering user behavior, I'm curious about the most common query patterns. What types of investigations are users typically conducting, and how complex are their queries on average?

Why it matters: Helps identify areas where simplification would have the most impact Expected answer: Mix of simple and complex queries, with a trend towards more complex investigations Impact on approach: Would prioritize tools for managing query complexity and reusability

• Regarding pain points, I'm wondering about the learning curve for new users. How long does it typically take for a new user to become proficient with the query language?

Why it matters: Indicates whether we should focus on onboarding improvements or advanced feature development Expected answer: Steep learning curve, taking weeks to months for full proficiency Impact on approach: Would emphasize intuitive query building and robust documentation

• Thinking about the product lifecycle, where does the query language stand in terms of maturity and feature completeness? Are we looking at incremental improvements or a major overhaul?

Why it matters: Guides the scope and ambition of our improvement proposals Expected answer: Mature product with a solid feature set, looking for refinement and usability improvements Impact on approach: Would focus on enhancing existing features and improving user experience rather than introducing entirely new concepts