Operations | Monitoring | ITSM | DevOps | Cloud

In this first episode (or at least the first REAL episode, yesterday’s “episode 0” doesn’t count) of Cribl on your coffee break, Leon does what we all do when we unwrap a shiny new data, telemetry, observability, or monitoring tool: He takes the shortest path to jamming some data into that thing and seeing what it looks like. Is it sophisticated? Nuanced? Well-thought-out? Hell no! But it scratches an itch. There will be time to do more real-world stuff tomorrow.

In this Black Hat talk, Nicole Beckwith introduces APEX (Adversarial Pattern Extraction and Correlation), a detection framework—not a Cribl product—that clusters TTP-based signals around entities to support behavioral detection. It is intended for security practitioners, SOC and detection teams, and threat hunters who want to learn how to use raw telemetry or OCSF data, TTP chaining, time windows, criticality, and cross-correlation to detect behavior beyond static indicators and rule-count coverage.

In this episode, Leon explores some of the new features, functions, updates, and improvements in release 4.19.1, which includes private links, setting a region per workspace, choosing a release channel per workspace, and a look at Output Routers, an incredibly useful (but unfortunately under-loved) feature that’s been around for a hot minute.

See how Cribl's AI Observability App gives teams one place to search, investigate, and report on AI telemetry across models, tools, and environments. In this 5-minute demo, we tackle cost, quality, security, and governance blind spots. Start treating AI observability as a telemetry problem. Collect once, use everywhere, no lock-in.