Cribl Integration

About this Integration

Cribl Stream’s out-of-the-box solution acts as a universal collector and receiver of security data sources, allowing SREs and SecOps teams to quickly ingest and normalize data using a best-in-class user experience. By leveraging Cribl Stream’s data filtering capabilities, users can not only remove unwanted or duplicated log data, but also enrich it with context - automatically adding related data from external sources — all in real time.

After filtering and enriching the log data, Cribl Stream allows users to route it to multiple destinations — your SIEM, APM, and/or Observability solution — in addition to sending ALL the data to low-cost storage locations, like Amazon S3. Storing an additional copy of raw logs in cloud object storage allows customers to mitigate the costly vendor’s re-hydration and data retrieval fees, but also enables ChaosSearch to provide full visibility and instant access to all their data.

The Benefits of using ChaosSearch with Cribl’s Observability Solution

SIMPLIFY LOG DATA COLLECTION

Stream can translate and format data into any tooling schema, meaning you can collect all of your data once and repurpose it for any destination. This process reduces the duplication of data ingestion and allows different teams to pick the best analytics solutions.

UNLIMITED LOG RETENTION

Remove cost-related constraints by keeping all the log data on low-cost cloud object storage like Amazon S3 or GCP, and enjoy unlimited log retention to support your analysis, investigation and research needs from this single source of truth.

INSTANT ACCESS AND FULL VISIBILITY INTO ALL LOG DATA

ChaosSearch transforms cloud object storage (AWS S3 & GCP) into a hot operational data lake, making log data instantly available for query and analysis. Avoid time-consuming re-hydration processes (and associated unexpected charges) before you can access your log data, especially in events like a security incident investigation where time to access data plays a critical factor.

Summary

Cribl Stream combined with the ChaosSearch Data Platform allows customers to leverage their current SIEM, APM and Observability solutions at an optimal level, enjoying the full breadth of capabilities but avoiding stretching the ingestion and retention limits of these tools, and the associated increase in complexity and cost.

With Cribl Stream and ChaosSearch customers can:

• Simplify collection data by formatting into any tooling schema
• Keep all log data on low-cost storage options like Amazon S3
• Get instant access to their log data directly from Amazon S3 using ChaosSearch
• Reduce cost and complexity of the existing SIEM, APM and Observability tools
• Enjoy unlimited log retention in a very cost-effective way
• Improve incident investigation, threat hunting, and malware research capability

To get started with Cribl Stream and ChaosSearch today, click here to try Cribl Stream Cloud for free and here to start a free trial of ChaosSearch.