styx/DEMO.md

Demo notes

{
  Node(func: eq(type, "matcher")){
    id
    target
    type
    full
    nodes {
      uid
      full
    }
  }
}

{
  Node(func: has(nodes)  ) {
    uid
    type
    target
    timestamp
    nodes {
      uid
      type
      full
      hostnames

    }
  }
}

Notes

• There is TOO MUCH junk data
• Upsert is not optimal
• What do we do with the data so it can be exploitable by analysts
• Sould we store matched data in an SQL-like db?