Your question is Schema Design for Security Telemetry. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Time-series security telemetry grows quickly and must support both high-ingest writes and fast analytical queries. In a security platform context, this often includes firewall, endpoint, and cloud events that need to be queried by time, asset, and threat dimensions.
You are asked to design a PostgreSQL schema for a large telemetry dataset similar to events collected from Palo Alto Networks Cortex XDR or Strata logging pipelines. Explain how you would model the core event table, which dimensions you would separate out, and how you would handle timestamps, high-cardinality fields, and evolving event attributes. You should also explain how you would make the schema queryable for common use cases such as recent incident investigation, trend analysis, and filtering by device, user, or severity.
The interviewer expects a practical database-design answer rather than a product architecture deep dive. Focus on relational schema choices, partitioning strategy, indexing, retention considerations, and the trade-offs between normalization and flexibility.