DSLs

DSLs#

A DSL is a small, focused language designed for a narrow problem. The operator meets them everywhere: regex on a log line, jq on an API response, YARA on a sample, Sigma on a SIEM, SPL on splunk, cron on a scheduler, Dockerfile on a build host. Pattern matching, querying, schema definition, text processing, build automation, detection content, and diagrams all live here.

A DSL trades generality for fluency: the syntax is awkward outside its domain and unbeatable inside it. Fluency in the major DSLs is most of what makes the operator fluent in the toolchain.

Pattern Languages#

Regex

The operator’s bread-and-butter pattern language. Log triage, indicator extraction, packet filters.

Regex

Glob

The simpler cousin of regex for matching filenames. Shells, .gitignore, rsync, find.

Glob

Cron

Five- or six-field schedule DSL. Unix cron, Kubernetes CronJob, GitHub Actions, EventBridge.

Cron

Query and Filter#

SQL

Structured Query Language. The declarative query DSL behind nine relational engines out of ten.

SQL

GraphQL

Schema-defined query language for HTTP APIs. Queries, mutations, subscriptions, the SDL.

GraphQL

jq

Standard CLI and language for querying and transforming JSON.

jq

XPath

Query language for XML and HTML. Standard for scraping and test automation.

XPath

Cypher

Query language for graph databases. Neo4j and the wider openCypher ecosystem.

Cypher

Schema, Grammar, and IDL#

BNF

Backus-Naur Form and variants. The standard notation for formal language syntax.

BNF

ProtoBuf

Google’s schema and IDL for typed structured data with codegen across languages.

ProtoBuf

Text Processing#

AWK

Pattern-action language for line-oriented text. POSIX, everywhere.

AWK

sed

The stream editor. Editing commands applied line by line.

sed

Build, Config, and Infrastructure#

Make

The original build DSL. Targets, prerequisites, recipes.

Make

Dockerfile

Small declarative DSL describing how to build a container image.

Dockerfile

HCL

HashiCorp Configuration Language. Behind Terraform, OpenTofu, Packer, Vault, Consul, Nomad.

HCL

Security and Policy#

YARA

Pattern-matching swiss knife for malware research. Textual and binary patterns.

YARA

Sigma

Vendor-agnostic detection rule language. Write once, convert to SIEM-native queries.

Sigma

IDS Rules

Snort and Suricata rule DSL for network packet patterns.

IDS Rules

Rego

Open Policy Agent’s policy language. Declarative, Datalog-derived is this allowed? decisions.

Rego

Cedar

AWS-released authorization policy language. Simpler than Rego, formally analyzable.

Cedar

KQL

Kusto Query Language. Microsoft’s DSL for Azure Data Explorer, Sentinel, M365 Defender.

KQL

SPL

Splunk’s Search Processing Language. Pipeline-shaped query DSL.

SPL

PromQL

Prometheus Query Language. Time-series metrics across the Prometheus-compatible stack.

PromQL

Falco

Cloud-native runtime security. YAML DSL describing suspicious behavior at the syscall level.