Query trust,
not just data.
CBQL scores every session against 34 behavioral signals in real time, so you can tell a human from a script without asking either one to prove it.
1
About CBQL
Youssef Emad
Software & ML Engineer · Founder of CertiLayer
CBQL was born out of a real problem: there was no good way to query behavioral biometrics data. SQL was too generic, and writing custom filters in Python was slow and error-prone.
So I built CBQL — a hand-written query language in Rust with a Python binding, a CLI REPL, and a desktop app. It's the query engine powering CertiLayer's behavioral analysis pipeline.
Built for behavioral data
Everything SQL cant do for time-series behavioral streams.
SQL-like syntax
Familiar syntax for anyone who knows SQL. SELECT, WHERE, GROUP BY, LIMIT — all work as expected.
Real-time streaming
STREAM queries run continuously against live behavioral data. Built for fraud detection and anomaly detection.
Pattern matching
SEQUENCE OF click → scroll → idle detects complex behavioral patterns that SQL can't express.
Rust-powered engine
Hand-written lexer, parser, and execution engine in Rust. No external parser generators. Zero dependencies on query tools.
Python bindings
pip install cbql and use CBQL from Python. Works with pandas, numpy, and any ML pipeline.
Multiple sources
CSV, PostgreSQL, Kafka, and CertiLayer API. Same syntax for all sources — the adapter handles the rest.
See it in action
Real CBQL queries running against live behavioral session data.
SELECT *
FROM sessions
WHERE risk_score > 80| user_id | hcs_score | risk_score | typing_speed |
|---|---|---|---|
| 2 | 0.4 | 90 | 280 |
| 3 | 0.5 | 85 | 310 |
Documentation
The complete syntax reference for CBQL — the query language behind CertiLayer's behavioral event pipeline.
Statements
5 featuresThe top-level entry points of a CBQL query.
SELECT * FROM <source> WHERE <condition>Query rows from a data source with optional filtering, ordering, and limiting.
SELECT * FROM sessions WHERE hcs_score < 0.4 ORDER BY ts DESC LIMIT 20FIND <source> WHERE <condition>Search for rows matching a condition. Similar to SELECT but optimized for point lookups.
FIND devices WHERE fingerprint = "a1c9…"STREAM <source> WHERE <condition> WITHIN last N minutesRun a continuous query against a live event stream.
STREAM events WHERE risk = "high" WITHIN last 5 minutesSEQUENCE OF event -> event -> ... WITHIN last N minutesDetect ordered behavioral patterns — e.g. click → scroll → idle.
SEQUENCE OF click -> scroll -> idle WITHIN last 2 minutesMATCH event -> event -> ...Alias for SEQUENCE. Shorter syntax for pattern matching.
MATCH keypress -> keypress -> pauseClauses
6 featuresModifiers that refine what a statement returns.
FROM <source>Specifies the data source. Required in SELECT.
WHERE <field> <op> <value>Filters rows. Supports AND, OR, NOT. Operators: =, !=, <, <=, >, >=
WITHIN last N minutes|hours|days|secondsTime window for filtering. Also supports SINCE and BETWEEN.
GROUP BY <field>Groups rows so aggregate functions can be applied per group.
ORDER BY <field> ASC|DESCSorts results by a field, ascending or descending.
LIMIT <n>Caps the number of rows returned.
Functions
5 featuresAggregations available inside SELECT and GROUP BY.
AVG(<field>)Returns the average value of a numeric field.
COUNT(<field>)Returns the number of matching rows.
MAX(<field>)Returns the maximum value.
MIN(<field>)Returns the minimum value.
SUM(<field>)Returns the sum of a numeric field.
Download CBQL
Free desktop app for Mac and Windows. No account required.
Installation
macOS
1. Download the .dmg file
2. Open the .dmg
3. Drag CBQL to Applications
4. Open CBQL from Applications
Windows
1. Download the .msi or .exe
2. Run the installer
3. Follow the setup wizard
4. Launch CBQL from Start menu
Also available as a Python package:
pip install cbql (coming soon)