Operations | Monitoring | ITSM | DevOps | Cloud

Cribl On Your Coffee Break Episode 1

In this first episode (or at least the first REAL episode, yesterday’s “episode 0” doesn’t count) of Cribl on your coffee break, Leon does what we all do when we unwrap a shiny new data, telemetry, observability, or monitoring tool: He takes the shortest path to jamming some data into that thing and seeing what it looks like. Is it sophisticated? Nuanced? Well-thought-out? Hell no! But it scratches an itch. There will be time to do more real-world stuff tomorrow.

Introducing APEX: Adversarial Pattern Extraction and Correlation

In this Black Hat talk, Nicole Beckwith introduces APEX (Adversarial Pattern Extraction and Correlation), a detection framework—not a Cribl product—that clusters TTP-based signals around entities to support behavioral detection. It is intended for security practitioners, SOC and detection teams, and threat hunters who want to learn how to use raw telemetry or OCSF data, TTP chaining, time windows, criticality, and cross-correlation to detect behavior beyond static indicators and rule-count coverage.

On Release Days We Wear Teal for release 4.19.1

In this episode, Leon explores some of the new features, functions, updates, and improvements in release 4.19.1, which includes private links, setting a region per workspace, choosing a release channel per workspace, and a look at Output Routers, an incredibly useful (but unfortunately under-loved) feature that’s been around for a hot minute.

On Release Days We Wear Teal Episode for release 4.19

In this episode, Leon explores some of the new features, functions, updates, and improvements in release 4.19, which includes a raft of AI-enabled features including the Cribl Apps, integrated MCP server, and the fact that AI features are now turned on by default. For more information, check out these links.

Why partners love working with Cribl

Hear directly from Cribl partners—including AWS—about what it’s really like to work together. This short is for technology and cloud partners, consulting firms, and customers who want a quick, human view of Cribl’s partner ecosystem and the value it delivers. In under two minutes, partners highlight Cribl’s partner program, the people they work with, and the outcomes they’re delivering for joint customers. You’ll hear about the FedRAMP opportunity, why “it’s all about the data” for AWS, and how Cribl helps get data where it needs to be for shared customers.

A new way to SIEM

For years, security teams have been sold the same bargain: send in more data, buy more tools, tune more rules, and you'll be better protected. In practice, a lot of teams have ended up with the opposite. They're carrying more cost and more complexity, and they still don't have much confidence that their detections are actually working the way they should. That's the backdrop for why Cribl is acquiring CardinalOps.