DNSFilter: Building a Delightful End User Experience with Analytics as Code

"We used to have so many spreadsheets," Serena, Director of Content Marketing at DNSFilter said. "It got messy."

It used to take four people, six months, and a mountain of ad hoc spreadsheets to publish their first security report. Today, they do it every quarter, with minimal spreadsheet usage.

The first time we did the report, it took about six months. We had to sit down and figure out how we were even going to build it. We had access to the data, but the process was tedious; it involved writing SQL queries manually.

Now, things are very different. We have dashboards in Holistics where I could just click in, see the trends, and get what I need. I use it every week. It's amazing, I no longer have to ask for help or check formulas, so we go from data to stories a lot faster.

- Serena, Director of Content Marketing at DNSFilter

Stories are part of what draws customers to DNSFilter, and part of what keeps them.

Serena’s content team uses threat detection data from DNSFilter's network traffic to uncover trends, anomalies, and real-world attack patterns, then turns those into customer-facing artifacts like security reports and marketing collateral. “Our data is a reflection of what’s happening externally,” she said. “It’s useful.”

By publishing reports to inform their customers about the latest threats or potential scams, DNSFilter positions itself as a cybersecurity leader with real-world impact.

Yet, before Holistics, getting to those insights was a painful, error-prone process. Serena described hours spent coordinating with data engineers, exporting raw numbers, checking math in spreadsheets, and trying to piece the story together manually. There was no visual to explore, no interface to validate what was correct or not, just a back-and-forth of one-off SQL queries and guesswork.

We’d have this giant spreadsheet. We’d often create trendlines or calculate the average for something. That means we had to add a formula.

And every time you have to do math, you know, it’s concerning because you're like, “Am I going to mess up the math?” So even if there are three of us looking at it, you still have that concern..

- Serena, Director of Content Marketing at DNSFilter

Serena's ability to explore data independently today is built on the foundation laid by Ian McLaren, DNSFilter's Business Intelligence Engineer. While Serena focuses on turning data into compelling, customer-focused reports, Ian works behind the scenes to ensure the data driving those stories is accurate, consistent, and reusable.

As a BI veteran, Ian had seen the bottlenecks of legacy BI tools: metric definitions scattered across reports, logic duplicated in SQL, and endless cycles of rebuilds every time the business asked a slightly different question. So when DNSFilter adopted Holistics, Ian saw an opportunity to build a system where logic could be defined once, reused everywhere, and trusted by non-technical users without fear of breaking anything.

Holistics’ AMQL (Analytics Modeling and Query Language) gave him the foundation to do exactly so.

My vision is that people don't have to talk to the data team at all. They should be able to build what they need.

And we're not there yet, but we're getting close. AMQL has really transformed how we approach metrics. It's helped us shift toward a metric-centric mindset, where business users can work with consistent, reusable, and business-friendly definitions they can trust.

- Ian McLaren, Business Intelligence Engineer at DNSFilter

At DNSFilter, Holistics' AML (Analytics Modeling Language) has become the backbone of a scalable self-service analytics environment. For Ian, AML offered something he hadn't seen in other tools: a fully programmable, modular semantic layer that made it possible to define analytical logic once and reuse it everywhere.

The value (of AML) is in defining it once, and everyone uses it. That gives you confidence that the numbers are consistent, no matter where they show up.

With AML, I'm able to build more reusable data sets. I'm taking the opportunity to build them out properly and make them really useful for everyone.

- Ian McLaren, Business Intelligence Engineer at DNSFilter

With AML, Ian can finally build reusable datasets the right way, without cutting corners or relying on brittle workarounds. That foundation has allowed DNSFilter to scale data access without scaling support overhead, empowering business stakeholders like Serena to self-serve using governed datasets and trusted, reusable metrics.

With AML as the foundation, AQL provided Ian a new level of expressiveness.

With most BI tools, even ones with a semantic layer, chaining metrics together required creating separate models, which broke lineage and made drilldowns impossible. “Finance modeling in particular, we had a lot of layered logic, things like our LTV model,” Ian explained.

“To get to certain metrics, it was always a few steps down. Take LTV (Life Time Value), for example. To calculate it, you first need ARPA, which is MRR divided by customer count. Then divide that by churn rate, which itself depends on customer retention over time. You’d need to stack these metrics on top of each other, and in most tools, you’d need to build each of those in a separate model. In doing so, you’d lose traceability.”

Now, with AQL’s ability to reference and compose metrics declaratively, Ian could structure logic once and reuse it consistently across use cases, from financial reports to marketing dashboards, without sacrificing transparency or governance.

I'd score AQL a 9 or 10. It's up there with the best tools I've used.

With AMQL, it's really cool that we can now define metrics based on other metrics, stacking them on top of each other, and still retain visibility into the raw data. For example, we can see exactly which customers contributed to a number, or what portion of a segment makes up a result. That really changed how we approached metrics.

- Ian McLaren, Business Intelligence Engineer at DNSFilter

This composability also made the analytics experience dramatically easier for downstream users like Serena. A task that once required manual data exports and offline calculations, like adding a dynamic average to a chart, was reduced to a few clicks.

To give you a simple example: Serena once had a chart and asked, “Can we show the average that changes depending on the selected time period?”

In the past, that would’ve meant going back into the model and fiddling with the logic to calculate a dynamic average. With AMQL, it’s just: add a reference line. What used to be difficult is now basically trivial. It’s definitely both a time-saver and a self-service enabler.”

- Ian McLaren, Business Intelligence Engineer at DNSFilter

One of the most powerful outcomes of DNSFilter's semantic modeling was how easily Ian's team could turn reusable BI definitions into flexible, user-friendly dashboards. At the heart of that delivery experience was Holistics' Canvas Dashboard, a visual interface built for clarity, speed, and customization.

With Canvas Dashboard, reusable BI definitions become modular analytics blocks that can be arranged flexibly to build customized dashboards that mirror how business users think about data. Every block – charts, control filters, markdown notes, and even embedded diagrams – could be moved freely, reused anywhere, or updated without breaking the whole dashboard.

For example, when someone needed to view “blocked domains by industry” instead of “by region”, Ian didn’t need to rewrite everything from scratch. He duplicated the Canvas, swapped the filter block, and had a new view live in minutes.

Being able to copy and paste the code and recreate the dashboard completely, and then change what we need. That's really powerful because it saves me so much time.

It's just easier to reuse dashboards now. If I want to show different cuts of the same metric, I just duplicate the Canvas and plug in the new filter.

- Ian McLaren, Business Intelligence Engineer at DNSFilter

For Serena, Canvas has become a creative workspace.

She can rearrange blocks, layer narratives, and quickly refine the data story as it develops, without compromising on governance or metric accuracy. The ability to style and export dashboards also makes Canvas a powerful presentation tool. For example, while working on DNSFilter’s Threat Report, Serena exported a threat map directly from Holistics, already styled with DNSFilter branding, and placed it straight into the final design.

Your branding capabilities have come a long way and that's been helpful. We're now able to customize much of the dashboard to stay on-brand.

For our report, we exported the map directly from Holistics and dropped it in. The brand team was really happy with how it turned out.

- Serena, Director of Content Marketing at DNSFilter

Ian has always had a high standard for what self-service analytics should enable. To Ian, true self-service means that any team, not just analysts, can explore data, answer their own questions, and even build dashboards from scratch if needed.

I've got a fairly high standard when it comes to self-service analytics.

I have a vision of everyone in our organization being able to go in and make their own dashboards from scratch.

- Ian McLaren, Business Intelligence Engineer at DNSFilter

Today, Ian's vision is beginning to take root.

The team now consistently sees over 95% monthly active usage in Holistics. People start to build reports on their own and use data to drive decisions across the business. This creates a flywheel effect: each successful interaction draws in more users.

This level of adoption was made possible by Ian's early decision to invest in a reusable semantic layer and structure the analytics environment around consistency, transparency, and modularity. Holistics provided the programmable foundation. Ian and his team translated that into a scalable, governed system that others could build on.