{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T13:09:37Z","timestamp":1778332177043,"version":"3.51.4"},"publisher-location":"Singapore","reference-count":28,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819203772","type":"print"},{"value":"9789819203789","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-981-92-0378-9_17","type":"book-chapter","created":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T12:20:15Z","timestamp":1778329215000},"page":"272-288","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["SecKQL-Agent: A Real-World APT29 Events Benchmark and\u00a0Framework for\u00a0Reliable Text-to-KQL in\u00a0Security Analytics"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7346-1850","authenticated-orcid":false,"given":"Huan","family":"Zhang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5702-9897","authenticated-orcid":false,"given":"Haiyan","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-3456-5491","authenticated-orcid":false,"given":"Shaofang","family":"Long","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1153-2726","authenticated-orcid":false,"given":"Hao","family":"Tan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-3854-975X","authenticated-orcid":false,"given":"Ziyu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yan","family":"Jia","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7546-852X","authenticated-orcid":false,"given":"Zhaoquan","family":"Gu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,5,10]]},"reference":[{"key":"17_CR1","unstructured":"Achiam, J., et al.: GPT-4 technical report (2023). arXiv preprint arXiv:2303.08774"},{"key":"17_CR2","doi-asserted-by":"crossref","unstructured":"Baik, C., Jagadish, H.V., Li, Y.: Bridging the semantic gap with SQL query logs in natural language interfaces to databases. In: 2019 IEEE 35th International Conference on Data Engineering (ICDE), pp. 374\u2013385. IEEE (2019)","DOI":"10.1109\/ICDE.2019.00041"},{"key":"17_CR3","unstructured":"Cao, Z., Zheng, Y., Fan, Z., Zhang, X., Chen, W.: RSL-SQL: robust schema linking in text-to-SQL generation (2024). arXiv preprint arXiv:2411.00073"},{"key":"17_CR4","unstructured":"Chen, X., Lin, M., Sch\u00e4rli, N., Zhou, D.: Teaching large language models to self-debug. In: International Conference on Learning Representations (2024)"},{"key":"17_CR5","unstructured":"Foundation, O.T.R.: Security-datasets: Apt29 (2020). https:\/\/github.com\/OTRF\/Security-Datasets\/tree\/master\/datasets\/compound\/apt29. gitHub repository, open dataset"},{"key":"17_CR6","unstructured":"Gao, D., et al.: Text-to-SQL empowered by large language models: a benchmark evaluation. CoRR. abs\/2308.15363 (2023)"},{"key":"17_CR7","doi-asserted-by":"crossref","unstructured":"Hong, Z., et al.: Next-generation database interfaces: a survey of LLM-based text-to-SQL. IEEE Trans. Knowl. Data Eng. (2025)","DOI":"10.1109\/TKDE.2025.3609486"},{"issue":"4","key":"17_CR8","doi-asserted-by":"publisher","first-page":"905","DOI":"10.1007\/s00778-022-00776-8","volume":"32","author":"G Katsogiannis-Meimarakis","year":"2023","unstructured":"Katsogiannis-Meimarakis, G., Koutrika, G.: A survey on deep learning approaches for text-to-SQL. VLDB J. 32(4), 905\u2013936 (2023)","journal-title":"VLDB J."},{"issue":"10","key":"17_CR9","doi-asserted-by":"publisher","first-page":"1737","DOI":"10.14778\/3401960.3401970","volume":"13","author":"H Kim","year":"2020","unstructured":"Kim, H., So, B.H., Han, W.S., Lee, H.: Natural language to SQL: Where are we today? Proc. VLDB Endowment 13(10), 1737\u20131750 (2020)","journal-title":"Proc. VLDB Endowment"},{"key":"17_CR10","unstructured":"Kun, J.: SecBERT: Pretrained BERT model for cyber security text (2023). https:\/\/github.com\/jackaduma\/SecBERT, gitHub repository"},{"key":"17_CR11","unstructured":"Lei, F., et\u00a0al.: Spider 2.0: evaluating language models on real-world enterprise text-to-SQL workflows. In: Yue, Y., Garg, A., Peng, N., Sha, F., Yu, R. (eds.) International Conference on Representation Learning, vol.\u00a02025, pp. 28691\u201328735 (2025)"},{"key":"17_CR12","doi-asserted-by":"publisher","unstructured":"Li, B., Luo, Y., Chai, C., Li, G., Tang, N.: The dawn of natural language to SQL: are we fully ready? Proc. VLDB Endow. 17(11), 3318\u20133331 (2024). https:\/\/doi.org\/10.14778\/3681954.3682003","DOI":"10.14778\/3681954.3682003"},{"issue":"3","key":"17_CR13","first-page":"1","volume":"2","author":"H Li","year":"2024","unstructured":"Li, H., et al.: Codes: towards building open-source language models for text-to-SQL. Proc. ACM Manage. Data 2(3), 1\u201328 (2024)","journal-title":"Proc. ACM Manage. Data"},{"key":"17_CR14","first-page":"42330","volume":"36","author":"J Li","year":"2023","unstructured":"Li, J., et al.: Can LLM already serve as a database interface? a big bench for large-scale database grounded text-to-SQLs. Adv. Neural. Inf. Process. Syst. 36, 42330\u201342357 (2023)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"17_CR15","doi-asserted-by":"publisher","unstructured":"Ma, S., et al.: Semantic-driven instance generation for table question answering. In: Wang, X., et al. International Conference on Database Systems for Advanced Applications, DASFAA 2023. LNCS, vol. 13943, pp. 3\u201318. Springer, Cham (2023). https:\/\/doi.org\/10.1007\/978-3-031-30637-2_1","DOI":"10.1007\/978-3-031-30637-2_1"},{"key":"17_CR16","unstructured":"Microsoft: Microsoft Sentinel Advanced Security Information Model (ASIM). Microsoft (2024). https:\/\/learn.microsoft.com\/azure\/sentinel\/normalization, industry-standard normalization layer and schemas for security logs, designed for KQL-based analytics and cross-event correlation"},{"key":"17_CR17","unstructured":"Microsoft: Kusto query language (KQL) overview (2025). https:\/\/learn.microsoft.com\/en-us\/kusto\/query\/. Accessed 26 Oct 2025"},{"key":"17_CR18","doi-asserted-by":"publisher","first-page":"36339","DOI":"10.52202\/075280-1577","volume":"36","author":"M Pourreza","year":"2023","unstructured":"Pourreza, M., Rafiei, D.: Din-SQL: decomposed in-context learning of text-to-SQL with self-correction. Adv. Neural. Inf. Process. Syst. 36, 36339\u201336348 (2023)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"17_CR19","doi-asserted-by":"publisher","unstructured":"Pourreza, M., Rafiei, D.: DTS-SQL: decomposed text-to-SQL with small large language models. In: Findings of the Association for Computational Linguistics: EMNLP 2024, Miami, USA, 12-16 Nov 2024, pp. 8212\u20138220 (2024). https:\/\/doi.org\/10.18653\/V1\/2024.FINDINGS-EMNLP.481","DOI":"10.18653\/V1\/2024.FINDINGS-EMNLP.481"},{"key":"17_CR20","unstructured":"Pourreza, M., et\u00a0al.: CHASE-SQL: multi-path reasoning and preference optimized candidate selection in text-to-SQL. In: The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore, 24-28 April 2025 (2025)"},{"key":"17_CR21","unstructured":"Splunk Inc.: Splunk enterprise search reference. https:\/\/docs.splunk.com\/Documentation\/Splunk\/latest\/SearchReference\/ (2025). Accessed 26 Oct 2025"},{"key":"17_CR22","unstructured":"Sugumaran, R., Jain, P.: Leveraging generative AI to translate natural language into kusto queries for connected car network monitoring, 30 ECTS credits; Supervisor: Fabian Lorig (2024)"},{"key":"17_CR23","unstructured":"Tang, X., et\u00a0al.: NL2KQL: from natural language to kusto query (2024). arXiv preprint arXiv:2404.02933"},{"key":"17_CR24","unstructured":"Wang, B., et\u00a0al.: MAC-SQL: a multi-agent collaborative framework for text-to-SQL. In: Proceedings of the 31st International Conference on Computational Linguistics, pp. 540\u2013557 (2025)"},{"key":"17_CR25","doi-asserted-by":"publisher","unstructured":"Wang, Y., et\u00a0al.: Self-instruct: aligning language models with self-generated instructions. In: ACL, pp. 13484\u201313508 (2023). https:\/\/doi.org\/10.18653\/V1\/2023.ACL-LONG.754","DOI":"10.18653\/V1\/2023.ACL-LONG.754"},{"key":"17_CR26","unstructured":"Yang, A., et\u00a0al.: Qwen3 technical report (2025). arXiv preprint arXiv:2505.09388"},{"key":"17_CR27","doi-asserted-by":"publisher","unstructured":"Yu, T., et\u00a0al.: Spider: a large-scale human-labeled dataset for complex and cross-domain semantic parsing and text-to-SQL task. In: EMNLP, pp. 3911\u20133921 (2018). https:\/\/doi.org\/10.18653\/V1\/D18-1425","DOI":"10.18653\/V1\/D18-1425"},{"key":"17_CR28","unstructured":"Zhong, V., Xiong, C., Socher, R.: Seq2SQL: generating structured queries from natural language using reinforcement learning (2017). arXiv preprint arXiv:1709.00103"}],"container-title":["Lecture Notes in Computer Science","Database Systems for Advanced Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-92-0378-9_17","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T12:20:20Z","timestamp":1778329220000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-92-0378-9_17"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9789819203772","9789819203789"],"references-count":28,"URL":"https:\/\/doi.org\/10.1007\/978-981-92-0378-9_17","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"10 May 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"The authors\u00a0have no competing interests to declare that are relevant to the content of this article.","order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Disclosure of Interests"}},{"value":"DASFAA","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Database Systems for Advanced Applications","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Jeju","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Korea (Republic of)","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27 April 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30 April 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"31","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"dasfaa2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/dasfaa2026.github.io\/index.html","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}