---
title: "How Artemis Security runs 69x faster detection queries with ClickHouse Cloud"
description: "Artemis Security uses ClickHouse Cloud on AWS for real-time threat detection across many terabytes of compressed logs, tens of billions of daily rows, and queries over trillions of rows. To reduce repeated scans, its engineers coalesce hundreds of detection-rule predicates into one query, tagging matching rows by rule ID; batches of more than 100 rules now run in under a second, with a measured 69x speedup. A Claude Code skill called /poke connects ClickHouse system tables, CloudWatch, Datadog, application data, and source code to investigate infrastructure issues through natural-language prompts. For investigative queries over semi-structured JSON, Artemis extracts frequently queried fields into a parallel materialized table and uses a hybrid two-step lookup, producing 30–60x faster queries and up to 400x lower CPU consumption."
---

# How Artemis Security runs 69x faster detection queries with ClickHouse Cloud

[Clickhouse](https://yomu.fyi/company/clickhouse) · Jul 1, 2026

**Type:** Benchmark

## Summary

Artemis Security uses ClickHouse Cloud on AWS for real-time threat detection across many terabytes of compressed logs, tens of billions of daily rows, and queries over trillions of rows. To reduce repeated scans, its engineers coalesce hundreds of detection-rule predicates into one query, tagging matching rows by rule ID; batches of more than 100 rules now run in under a second, with a measured 69x speedup. A Claude Code skill called /poke connects ClickHouse system tables, CloudWatch, Datadog, application data, and source code to investigate infrastructure issues through natural-language prompts. For investigative queries over semi-structured JSON, Artemis extracts frequently queried fields into a parallel materialized table and uses a hybrid two-step lookup, producing 30–60x faster queries and up to 400x lower CPU consumption.

## Context

Artemis processes many terabytes of compressed log data each day, runs millions of queries against trillions of rows, and continuously evaluates detection rules across fresh and historical telemetry. Repeated scans, evolving semi-structured schemas, and the need to investigate suspicious behavior quickly created data-plane performance challenges.

## Approach / What changed

Artemis combines three engineering techniques: query coalescing for compatible detection rules, a Claude Code /poke skill that correlates ClickHouse and infrastructure data for debugging, and parallel materialized tables containing frequently queried JSON sub-columns. Its hybrid query pattern filters the extracted table first, then reads the full JSON table only for the resulting time slice.

## Takeaways

- Coalescing detection-rule predicates into one scan reduced a representative query from 173 seconds to 2.5 seconds, using 46x less CPU and 100x less memory I/O.
- A runtime classifier excludes roughly 15% of rules that cannot be coalesced; size-aware batching and binary-split fallback prevent one oversized or invalid rule from failing a whole batch.
- Extracting JSON fields into a parallel materialized table reduced one lookup from 12 seconds to 0.2 seconds and reduced CPU consumption by 60x to 400x, depending on workload.

**Tags:** [AWS](https://yomu.fyi/topic/aws), [Observability](https://yomu.fyi/topic/observability), [Performance](https://yomu.fyi/topic/performance)

- Source: [Clickhouse](https://clickhouse.com/blog/artemis-security-real-time-threat-detection)
- Source URL: https://clickhouse.com/blog/artemis-security-real-time-threat-detection
- Ingested by Yomu: 2026-08-29T01:37:26.509Z

[Read original post](https://clickhouse.com/blog/artemis-security-real-time-threat-detection)