Listing Thumbnail

    Cribl.Cloud Suite

     Info
    Sold by: Cribl 
    Deployed on AWS
    Free Trial
    Vendor Insights
    Quick Launch
    Cribl.Cloud gives control over IT and security data without the hassle of running infrastructure.

    Overview

    Play video

    Cribl.Cloud is the easiest way to try Cribl products in the cloud through a unified platform. Cribls suite of products gives flexibility and control back to customers. With routing, shaping, enriching, and search functionalities that make data more manageable, you can easily clean up your data, get it where it needs to be, work more efficiently, and ultimately gain the control and confidence needed to be successful.

    Cribl Cloud suite of products includes:

    Stream: A highly scalable data router for data collection, reduction, enrichment, and routing of observability data.

    Edge: An intelligent, scalable edge-based data collection system for logs, metrics, and application data.

    Lake: Storage that does not lock data in. Cribl Lake is a turnkey data lake makes it easy and economical to store, access, replay, and analyze data no expertise needed.

    Search: A search feature to perform federated search-in-place queries on any data, in any form.

    Getting Started

    When you purchase your Cribl.Cloud subscription directly from the AWS Marketplace, you can experience a smooth billing process that you're already familiar with, without needing to set up a separate procurement plan to use Cribl products. Track billing and usage directly in Cribl.Cloud.

    Enjoy a quick and easy purchasing experience by utilizing your existing spend commitments through the AWS Enterprise Discount Program (EDP) to subscribe to Cribl.Cloud. Get flexible pricing and terms by purchasing through a private offer. Purchase the Cribl Cloud Suite of offerings at a pre-negotiated price. Contact awsmp@cribl.io  or a sales representative for flexible pricing for 12/24/36-month terms.

    We are available in US-West-2 (Oregon), US-East-2 (Ohio), US-East-1 (Virginia), CA-Central-1 (Canada Central), EU-West-2 (London), EU-Central-1 (Frankfurt), and AP-Southeast-2 (Sydney) with more regions coming soon! Regional pricing will apply.

    To learn more about pricing and the consumption pricing philosophy, please visit: Cribl Pricing - https://cribl.io/cribl-pricing/  Cribl.Cloud Simplified with Consumption Pricing Blog - https://cribl.io/blog/cribl-cloud-consumption-pricing/ 

    Highlights

    • Fast and easy onboarding - With zero-touch deployment, you can quickly start using Cribl products without the hassle, burden, and cost of managing infrastructure.
    • Instant scalability - The cloud provides flexibility to easily scale up or down to meet changing business needs and dynamic data demands.
    • Trusted security - Cribl knows how important protecting data is, and built all Cribl products and services from the ground up with security as the top priority. Cribl.Cloud is SOC 2 compliant, ensuring all your data is protected and secure. Cribl.Cloud is currently In Process for FedRAMP IL4.

    Details

    Sold by

    Delivery method

    Deployed on AWS

    Unlock automation with AI agent solutions

    Fast-track AI initiatives with agents, tools, and solutions from AWS Partners.
    AI Agents

    Features and programs

    Vendor Insights

     Info
    Skip the manual risk assessment. Get verified and regularly updated security info on this product with Vendor Insights.
    Security credentials achieved
    (2)

    Buyer guide

    Gain valuable insights from real users who purchased this product, powered by PeerSpot.
    Buyer guide

    Financing for AWS Marketplace purchases

    AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
    Financing for AWS Marketplace purchases

    Quick Launch

    Leverage AWS CloudFormation templates to reduce the time and resources required to configure, deploy, and launch your software.

    Pricing

    Free trial

    Try this product free according to the free trial terms set by the vendor.

    Cribl.Cloud Suite

     Info
    Pricing is based on the duration and terms of your contract with the vendor, and additional usage. You pay upfront or in installments according to your contract terms with the vendor. This entitles you to a specified quantity of use for the contract duration. Usage-based pricing is in effect for overages or additional usage not covered in the contract. These charges are applied on top of the contract price. If you choose not to renew or replace your contract before the contract end date, access to your entitlements will expire.
    Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator  to estimate your infrastructure costs.

    12-month contract (2)

     Info
    Dimension
    Description
    Cost/12 months
    Cribl.Cloud Free
    Cribl.Cloud Suite Free Tier
    $0.00
    Cribl.Cloud Enterprise
    Cribl.Cloud Suite Enterprise with 1TB Daily ingestion
    $142,800.00

    Additional usage costs (1)

     Info

    The following dimensions are not included in the contract terms, which will be charged based on your usage.

    Dimension
    Cost/unit
    Overage Fees
    $0.01

    Vendor refund policy

    Cribl will refund prior payments attributable to the unused remainder of your purchase.

    Custom pricing options

    Request a private offer to receive a custom quote.

    How can we make this page better?

    We'd like to hear your feedback and ideas on how to improve this page.
    We'd like to hear your feedback and ideas on how to improve this page.

    Legal

    Vendor terms and conditions

    Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .

    Content disclaimer

    Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.

    Usage information

     Info

    Delivery details

    Software as a Service (SaaS)

    SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.

    Additional details

    Usage instructions

    Cribl Cloud Trust IAM Role CloudFormation Template

    This CloudFormation template creates an IAM role that allows Cribl Cloud to access specific AWS resources in your account. The role is designed to provide Cribl Cloud with the necessary permissions to interact with S3 buckets and SQS queues.

    Template Overview

    The template does the following:

    1. Creates an IAM role named CriblTrustCloud
    2. Configures a trust relationship with Cribl Cloud's AWS account
    3. Attaches a policy that grants access to S3 and SQS resources
    4. Outputs the role name, ARN, and an external ID for authentication

    Parameters

    • CriblCloudAccountID: The AWS account ID of Cribl Cloud (default: '012345678910')

    IAM Role Details

    Trust Relationship

    The role trusts two specific roles in the Cribl Cloud account:

    • arn:aws:iam::{CriblCloudAccountID}:role/search-exec-main
    • arn:aws:iam::{CriblCloudAccountID}:role/main-default

    These roles can assume the CriblTrustCloud role using the sts:AssumeRole, sts:TagSession, and sts:SetSourceIdentity actions.

    Permissions

    The role has a policy named CriblCloudS3SQSPolicy that grants the following permissions:

    1. S3 access:
      • List buckets
      • Get and put objects
      • Get bucket location
    2. SQS access:
      • Receive and delete messages
      • Change message visibility
      • Get queue attributes and URL

    These permissions apply to all S3 buckets and SQS queues in the account.

    Security Feature

    The template includes a security feature that requires an external ID for authentication. This external ID is derived from the CloudFormation stack ID, providing an additional layer of security when assuming the role.

    Outputs

    The template provides three outputs:

    1. RoleName: The name of the created IAM role
    2. RoleArn: The ARN of the created role
    3. ExternalId: The external ID required for authentication when assuming the role

    Usage

    To use this template:

    1. Deploy it in your AWS account using CloudFormation
    2. Provide the resulting role ARN and external ID to Cribl Cloud
    3. Cribl Cloud can then assume this role to access your S3 and SQS resources

    Remember to review and adjust the permissions as necessary to align with your security requirements and the specific needs of your Cribl Cloud integration1 2 3 .

    <div style="text-align: center">⁂</div>

    Enable CloudTrail and VPC Flow Logging for Cribl Cloud

    This document explains the resources that will be created when deploying the provided CloudFormation template. The template is designed to create an IAM role that trusts Cribl Cloud and sets up CloudTrail and VPC Flow logging to an S3 bucket.

    Template Overview

    The template automates the creation of AWS resources to enable centralized logging, specifically focusing on CloudTrail logs and VPC Flow Logs. It creates S3 buckets for storing these logs, SQS queues for triggering processes upon log arrival, and an IAM role to allow Cribl Cloud to access these logs.

    Resources Created

    Here's a breakdown of the resources defined in the CloudFormation template:

    • CriblCTQueue (AWS::SQS::Queue): Creates an SQS queue named according to the CTSQS parameter (default: cribl-cloudtrail-sqs). This queue will be used to trigger actions when new CloudTrail logs are written to the S3 bucket.

      • Properties:
        • QueueName: !Ref CTSQS - Sets the queue name to the value of the CTSQS parameter.
    • CriblCTQueuePolicy (AWS::SQS::QueuePolicy): Defines the policy for the CriblCTQueue, allowing s3.amazonaws.com to send messages to the queue. The policy includes a condition that the source account must match the AWS account ID in which the stack is deployed. This ensures only S3 events from the current AWS account can trigger the queue.

      • Properties:
        • PolicyDocument:
          • Statement:
            • Effect: Allow - Allows actions specified in the policy.
            • Principal: Service: s3.amazonaws.com - Specifies the service that can perform the actions.
            • Action: SQS:SendMessage - Allows sending messages to the queue.
            • Resource: !GetAtt CriblCTQueue.Arn - The ARN of the SQS queue.
            • Condition:
              • StringEquals: 'aws:SourceAccount': !Ref AWS::AccountId - Restricts the source account to the account where the stack is deployed.
        • Queues: !Ref CTSQS - Associates the policy with the SQS queue.
    • TrailBucket (AWS::S3::Bucket): Creates an S3 bucket used to store CloudTrail logs. The bucket is configured with a NotificationConfiguration that sends an event to the CriblCTQueue when a new object is created (specifically, a PUT operation). This will trigger processing when new CloudTrail logs are available.

      • Properties:
        • NotificationConfiguration:
          • QueueConfigurations:
            • Event: s3:ObjectCreated:Put - Specifies that the notification should be triggered when an object is created using a PUT operation.
            • Queue: !GetAtt CriblCTQueue.Arn - The ARN of the SQS queue to send the notification to.
      • DependsOn: CriblCTQueuePolicy - Ensures that the queue policy is created before the bucket.
    • TrailBucketPolicy (AWS::S3::BucketPolicy): Defines the policy for the TrailBucket. This policy grants permissions to:

      • delivery.logs.amazonaws.com: Allows the AWS Logs service to write objects to the bucket, ensuring proper log delivery. It requires bucket-owner-full-control ACL.

      • cloudtrail.amazonaws.com: Allows CloudTrail to get the bucket ACL and put objects into the bucket. It also requires bucket-owner-full-control ACL.

      • A Deny statement that enforces the use of SSL for all requests to the bucket, enhancing security.

      • Properties:

        • Bucket: !Ref TrailBucket - The name of the S3 bucket.
        • PolicyDocument:
          • Version: 2012-10-17 - The version of the policy document.
          • Statement:
            • Sid: AWSLogDeliveryWrite
              • Effect: Allow - Allows the action specified.
              • Principal: Service: delivery.logs.amazonaws.com - The AWS Logs service principal.
              • Action: s3:PutObject - Allows putting objects into the bucket.
              • Resource: !Sub '${TrailBucket.Arn}/AWSLogs/' - The S3 bucket and prefix to allow the action on.
              • Condition: StringEquals: 's3:x-amz-acl': bucket-owner-full-control - Requires the bucket-owner-full-control ACL.
            • Sid: AWSCloudTrailAclCheck
              • Effect: Allow
              • Principal: Service: cloudtrail.amazonaws.com
              • Action: s3:GetBucketAcl
              • Resource: !Sub '${TrailBucket.Arn}'
            • Sid: AWSCloudTrailWrite
              • Effect: Allow
              • Principal: Service: cloudtrail.amazonaws.com
              • Action: s3:PutObject
              • Resource: !Sub '${TrailBucket.Arn}/AWSLogs/*/*'
              • Condition: StringEquals: 's3:x-amz-acl': 'bucket-owner-full-control'
            • Sid: AllowSSLRequestsOnly
              • Effect: Deny
              • Principal: * - Applies to all principals.
              • Action: s3:* - Denies all S3 actions.
              • Resource:
                • !GetAtt TrailBucket.Arn
                • !Sub '${TrailBucket.Arn}/*'
              • Condition: Bool: 'aws:SecureTransport': false - Denies requests that are not using SSL.
    • ExternalTrail (AWS::CloudTrail::Trail): Creates a CloudTrail trail. It is configured to:

      • Store logs in the TrailBucket.

      • Include global service events.

      • Enable logging.

      • Create a multi-region trail.

      • Enable log file validation.

      • Properties:

        • S3BucketName: !Ref TrailBucket - The name of the S3 bucket where the logs will be stored.
        • IncludeGlobalServiceEvents: true - Includes global service events.
        • IsLogging: true - Enables logging.
        • IsMultiRegionTrail: true - Creates a multi-region trail.
        • EnableLogFileValidation: true - Enables log file validation.
        • TrailName: !Sub '${TrailBucket}-trail' - Sets the name of the trail.
      • DependsOn:

        • TrailBucket
        • TrailBucketPolicy
    • CriblVPCQueue (AWS::SQS::Queue): Creates an SQS queue named according to the VPCSQS parameter (default: cribl-vpc-sqs). This queue will be used to trigger actions when new VPC Flow Logs are written to the S3 bucket.

      • Properties:
        • QueueName: !Ref VPCSQS - Sets the queue name.
    • CriblVPCQueuePolicy (AWS::SQS::QueuePolicy): Defines the policy for the CriblVPCQueue, allowing s3.amazonaws.com to send messages to the queue. Similar to CriblCTQueuePolicy, it restricts access to events originating from the same AWS account.

      • Properties:
        • PolicyDocument:
          • Statement:
            • Effect: Allow
            • Principal: Service: s3.amazonaws.com
            • Action: SQS:SendMessage
            • Resource: !GetAtt CriblVPCQueue.Arn
            • Condition: StringEquals: 'aws:SourceAccount': !Ref "AWS::AccountId"
        • Queues: !Ref VPCSQS
    • LogBucket (AWS::S3::Bucket): Creates an S3 bucket used to store VPC Flow Logs. The bucket is configured with a NotificationConfiguration to send an event to the CriblVPCQueue when new objects are created.

      • Properties:
        • NotificationConfiguration:
          • QueueConfigurations:
            • Event: s3:ObjectCreated:Put
            • Queue: !GetAtt CriblVPCQueue.Arn
      • DependsOn: CriblVPCQueuePolicy
    • LogBucketPolicy (AWS::S3::BucketPolicy): Defines the policy for the LogBucket. This policy grants permissions to:

      • delivery.logs.amazonaws.com: Allows the AWS Logs service to write objects to the bucket. It requires bucket-owner-full-control ACL.

      • Allows delivery.logs.amazonaws.com to get the bucket ACL.

      • Enforces SSL for all requests to the bucket.

      • Properties:

        • Bucket: !Ref LogBucket
        • PolicyDocument:
          • Version: 2012-10-17
          • Statement:
            • Sid: AWSLogDeliveryWrite
              • Effect: Allow
              • Principal: Service: delivery.logs.amazonaws.com
              • Action: s3:PutObject
              • Resource: !Sub '${LogBucket.Arn}/AWSLogs/${AWS::AccountId}/*'
              • Condition: StringEquals: 's3:x-amz-acl': bucket-owner-full-control
            • Sid: AWSLogDeliveryAclCheck
              • Effect: Allow
              • Principal: Service: delivery.logs.amazonaws.com
              • Action: s3:GetBucketAcl
              • Resource: !GetAtt LogBucket.Arn
            • Sid: AllowSSLRequestsOnly
              • Effect: Deny
              • Principal: *
              • Action: s3:*
              • Resource:
                • !GetAtt LogBucket.Arn
                • !Sub '${LogBucket.Arn}/*'
              • Condition: Bool: 'aws:SecureTransport': false
    • FlowLog (AWS::EC2::FlowLog): Creates a VPC Flow Log that captures network traffic information for the VPC specified in the VPCId parameter. The flow logs are stored in the LogBucket. The type of traffic to log is determined by the TrafficType parameter (ALL, ACCEPT, or REJECT).

      • Properties:
        • LogDestination: !Sub 'arn:${AWS::Partition}:s3:::${LogBucket}' - The ARN of the S3 bucket where the flow logs will be stored.
        • LogDestinationType: s3 - Specifies that the destination is an S3 bucket.
        • ResourceId: !Ref VPCId - The ID of the VPC to log.
        • ResourceType: VPC - Specifies that the resource is a VPC.
        • TrafficType: !Ref TrafficType - The type of traffic to log (ALL, ACCEPT, REJECT).
    • CriblTrustCloud (AWS::IAM::Role): Creates an IAM role that allows Cribl Cloud to access AWS resources.

      • Properties:
        • AssumeRolePolicyDocument:
          • Version: 2012-10-17
          • Statement:
            • Effect: Allow
            • Principal:
              • AWS:
                • !Sub 'arn:aws:iam::${CriblCloudAccountID}:role/search-exec-main'
                • !Sub 'arn:aws:iam::${CriblCloudAccountID}:role/main-default'
            • Action:
              • sts:AssumeRole
              • sts:TagSession
              • sts:SetSourceIdentity
            • Condition:
              • StringEquals: 'sts:ExternalId': !Select - 4 - !Split - '-' - !Select - 2 - !Split - '/' - !Ref 'AWS::StackId'
        • Description: Role to provide access AWS resources from Cribl Cloud Trust
        • Policies:
          • PolicyName: SQS
            • PolicyDocument:
              • Version: 2012-10-17
              • Statement:
                • Effect: Allow
                • Action:
                  • sqs:ReceiveMessage
                  • sqs:DeleteMessage
                  • sqs:GetQueueAttributes
                  • sqs:GetQueueUrl
                • Resource:
                  • !GetAtt CriblCTQueue.Arn
                  • !GetAtt CriblVPCQueue.Arn
          • PolicyName: S3EmbeddedInlinePolicy
            • PolicyDocument:
              • Version: 2012-10-17
              • Statement:
                • Effect: Allow
                • Action:
                  • s3:ListBucket
                  • s3:GetObject
                  • s3:PutObject
                  • s3:GetBucketLocation
                • Resource:
                  • !Sub ${TrailBucket.Arn}
                  • !Sub ${TrailBucket.Arn}/*
                  • !Sub ${LogBucket.Arn}
                  • !Sub ${LogBucket.Arn}/*

    Parameters

    The template utilizes parameters to allow customization during deployment:

    • CriblCloudAccountID: The AWS account ID of the Cribl Cloud instance. This is required for the IAM role's trust relationship.
      • Description: Cribl Cloud Trust AWS Account ID. Navigate to Cribl.Cloud, go to Workspace and click on Access. Find the Trust and copy the AWS Account ID found in the trust ARN.
      • Type: String
      • Default: '012345678910'
    • CTSQS: The name of the SQS queue for CloudTrail logs.
      • Description: Name of the SQS queue for CloudTrail to trigger for S3 log retrieval.
      • Type: String
      • Default: cribl-cloudtrail-sqs
    • TrafficType: The type of traffic to log for VPC Flow Logs (ALL, ACCEPT, REJECT).
      • Description: The type of traffic to log.
      • Type: String
      • Default: ALL
      • AllowedValues: ACCEPT, REJECT, ALL
    • VPCSQS: The name of the SQS queue for VPC Flow Logs.
      • Description: Name of the SQS for VPCFlow Logs.
      • Type: String
      • Default: cribl-vpc-sqs
    • VPCId: The ID of the VPC for which to enable flow logging.
      • Description: Select your VPC to enable logging
      • Type: AWS::EC2::VPC::Id

    Outputs

    The template defines outputs that provide key information about the created resources:

    • CloudTrailS3Bucket: The ARN of the S3 bucket storing CloudTrail logs.
      • Description: Amazon S3 Bucket for CloudTrail Events
      • Value: !GetAtt TrailBucket.Arn
    • VPCFlowLogsS3Bucket: The ARN of the S3 bucket storing VPC Flow Logs.
      • Description: Amazon S3 Bucket for VPC Flow Logs
      • Value: !GetAtt LogBucket.Arn
    • RoleName: The name of the created IAM role.
      • Description: Name of created IAM Role
      • Value: !Ref CriblTrustCloud
    • RoleArn: The ARN of the created IAM role.
      • Description: Arn of created Role
      • Value: !GetAtt CriblTrustCloud.Arn
    • ExternalId: The external ID used for authentication when assuming the IAM role.
      • Description: External Id for authentication
      • Value: !Select - 4 - !Split - '-' - !Select - 2 - !Split - '/' - !Ref 'AWS::StackId'

    Deployment Considerations

    • Cribl Cloud Account ID: Ensure the CriblCloudAccountID parameter is set to the correct AWS account ID for your Cribl Cloud instance. This is crucial for establishing the trust relationship.
    • S3 Bucket Names: S3 bucket names must be globally unique. If the template is deployed multiple times in the same region, you may need to adjust the names of the buckets. Consider using a Stack name prefix.
    • VPC ID: The VPCId parameter should be set to the ID of the VPC for which you want to enable flow logging.
    • Security: Regularly review and update IAM policies to adhere to the principle of least privilege. Consider using more restrictive S3 bucket policies if necessary.
    • SQS Queue Configuration: Monitor the SQS queues for backlog and adjust the processing capacity accordingly.
    • CloudTrail Configuration: Confirm that CloudTrail is properly configured to deliver logs to the designated S3 bucket.
    • VPC Flow Log Configuration: Verify that VPC Flow Logs are correctly capturing network traffic.
    • External ID: The External ID is a critical security measure for cross-account access. Make sure it's correctly configured in both AWS and Cribl Cloud.

    This detailed explanation provides a comprehensive understanding of the resources created by the CloudFormation template, enabling informed deployment and management. Remember to adapt parameters to your specific environment and security requirements.

    Footnotes

    1. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html   

    2. https://github.com/criblio/cribl-aws-cloudformation-templates   

    3. https://awsfundamentals.com/blog/aws-iam-roles-with-aws-cloudformation   

    Support

    AWS infrastructure support

    AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.

    Product comparison

     Info
    Updated weekly

    Accolades

     Info
    Top
    10
    In Log Management, Security Observability
    Top
    10
    In Migration, Monitoring, Continuous Integration and Continuous Delivery

    Customer reviews

     Info
    Sentiment is AI generated from actual customer reviews on AWS and G2
    Reviews
    Functionality
    Ease of use
    Customer service
    Cost effectiveness
    3 reviews
    Insufficient data
    Insufficient data
    Insufficient data
    Insufficient data
    0 reviews
    Insufficient data
    Insufficient data
    Insufficient data
    Insufficient data
    Positive reviews
    Mixed reviews
    Negative reviews

    Overview

     Info
    AI generated from product descriptions
    Data Routing
    Highly scalable data router for collection, reduction, enrichment, and routing of observability data
    Edge Data Collection
    Intelligent and scalable edge-based system for collecting logs, metrics, and application data
    Data Lake Storage
    Flexible storage solution that enables storing, accessing, replaying, and analyzing data without expertise requirements
    Federated Search
    Capability to perform search-in-place queries across diverse data formats and sources
    Security Compliance
    SOC 2 compliant platform with in-process FedRAMP IL4 certification, built with security as a core design principle
    Data Collection and Indexing
    Real-time collection and indexing of machine-generated data from diverse sources and locations
    Event Correlation
    Advanced correlation capabilities including time-based, transaction-based, sub-searches, lookups, and joins across multiple data sources
    Scalability
    Capability to collect and index tens of terabytes of data per day with distributed computing architecture
    High Availability
    Clustering technology ensuring continuous data availability and system reliability during scale-out operations
    Machine Data Analysis
    Comprehensive platform for searching, analyzing, and visualizing massive streams of machine data from physical, virtual, and cloud infrastructures
    Telemetry Data Management
    Comprehensive platform to ingest, analyze, and alert on metrics, events, logs, and traces across infrastructure
    Multi-Stack Observability
    Full-stack monitoring capability providing integrated visualization and troubleshooting across software environments
    Intelligent Anomaly Detection
    Automated system for detecting performance anomalies, correlating issues, and reducing alert noise
    AWS Service Integration
    Deep integration with AWS technology stack enabling telemetry data collection from multiple AWS services including EKS, Lambda, Kinesis, and CloudWatch
    SAP Environment Monitoring
    Agentless monitoring solution supporting multiple SAP systems including RISE, ECC, S/4HANA, BTP with insights into CPU, databases, RFC details, and background jobs

    Security credentials

     Info
    Validated by AWS Marketplace
    FedRAMP
    GDPR
    HIPAA
    ISO/IEC 27001
    PCI DSS
    SOC 2 Type 2
    -
    -
    -
    -
    No security profile
    No security profile

    Contract

     Info
    Standard contract
    No
    No
    No

    Customer reviews

    Ratings and reviews

     Info
    4.2
    3 ratings
    5 star
    4 star
    3 star
    2 star
    1 star
    0%
    100%
    0%
    0%
    0%
    3 AWS reviews
    |
    17 external reviews
    Star ratings include only reviews from verified AWS customers. External reviews can also include a star rating, but star ratings from external reviews are not averaged in with the AWS customer star ratings.
    Adan Castaneda

    Has streamlined data routing across repositories and enabled flexible pipeline maintenance

    Reviewed on Sep 22, 2025
    Review provided by PeerSpot

    What is our primary use case?

    My current use cases involve using it as a pipeline to process data, to route data from cloud logs to different repositories. Some data goes to Splunk and others go to different data lakes. I didn't work with the firewall logs directly. We use Cribl  to process web activity and route data that we wanted to into Splunk ES to create detections.

    What is most valuable?

    What I appreciate the most about Cribl  is the free training, the free access to all the training, and how easy it is to learn it. Cribl is great in handling high volumes of diverse data types, such as logs and metrics. It does the job.

    What needs improvement?

    The product is very good. They could add more AI-assisted pipeline development in the future release.

    For how long have I used the solution?

    I have been using Cribl for six months.

    What do I think about the stability of the solution?

    I haven't seen any lagging or crashing with Cribl.

    What do I think about the scalability of the solution?

    Cribl's scalability is very good.

    How are customer service and support?

    I have never contacted the technical support or customer support of Cribl.

    How would you rate customer service and support?

    Positive

    How was the initial setup?

    The initial deployment when I first started with Cribl was fairly easy, very easy.

    What about the implementation team?

    We were a team for this job.

    What other advice do I have?

    I have used alternatives to Cribl. I forgot the name, but it's a CrowdStrike product they just acquired that is the closest one I've used to Cribl in terms of the quality and the features. Currently, I prefer Cribl more than CrowdStrike. I still haven't played much with the other one, but I didn't find any issues with Cribl.

    Regarding Cribl's ability to contain data cost and complexity, if they can reduce their cost, that will make them more competitive. However, I don't know what else they can do in regards to how the application works. It's very good.

    For the project that I was involved in, it took me probably three weeks to set it up. We had to maintain our pipelines, not because of anything related to Cribl itself, but because the data source changed, so we had to adjust our pipelines. That was the kind of maintenance that we did.

    I would rate Cribl a nine out of ten.

    Manoj Gowda J

    Helps reduce log ingestion cost by dropping unnecessary events and customizing pipelines

    Reviewed on Sep 19, 2025
    Review from a verified AWS customer

    What is our primary use case?

    Our use case for Cribl  is actually a data pipeline where we collect logs from the source and we stream it through Cribl  and then to a destination. The destination is mainly the SIEM  tools such as CrowdStrike or SecOps. We collect the logs from various sources, and even the Windows logs are streamed through Cribl worker nodes and data lakes. For example, if it is AWS , from the S3  bucket we stream to Cribl and then send it to Google SecOps, which is the primary SIEM  we are using.

    What is most valuable?

    The best feature in Cribl, when getting logs from some custom application, is the ability to break up logs that pile up together and come as one event. 

    Cribl has a feature called JSON Unroll or Unroll function that allows you to differentiate the events; each event will come ingested as a single log instead of piling it up with multiple events. This is critical as this generally happens in CrowdStrike. This feature helps us significantly.

    When the ingestion is high from unwanted logs, logs not related to security purposes can be dropped by writing the parser function. By dropping events that are not required for security purpose monitoring, we can reduce the ingestion, which drastically reduces the cost as well. Cribl gives another option where I can store some logs, and when needed, I can pick them up from there.

    The interface is very handy and not very complicated, yet there are many functions you can perform. You can play around with numerous functions, parse there, and add UDMs to SecOps, which makes it really easy.

    To simplify the pipeline, when we go to the pipelines, there are vast options. We can make it specific requirements based on the customers. I would prefer a customized or simplified version. Cribl is a very good platform to work with, with lots of features that other platforms don't provide.

    What needs improvement?

    Cribl is a stable product, however, there are areas for improvement. Their documentation should be updated.

    For how long have I used the solution?

    I have been using Cribl for a year and a half.

    What do I think about the stability of the solution?

    Cribl is a stable product, but there are areas for improvement. Since Cribl is on-premises, server maintenance is required, and we have an IT team specifically to look into that. We are not worried about that.

    What do I think about the scalability of the solution?

    There is a similar platform by Google called BindPlane, which is not capable of handling high volumes of data as the data gets stuck in the pipeline, causing ingestion delays. 

    However, Cribl does not present that problem. Since I have worked with both data pipeline tools, I can compare and say that Cribl is more mature than others.

    How are customer service and support?

    I have not reached out to Cribl support. That said, my colleagues have.

    How would you rate customer service and support?

    Positive

    Which solution did I use previously and why did I switch?

    I'm using another product called BindPlane, which does almost the same things; however, Cribl is a very mature product with many functions. You can use the Eval function, Unroll function, break events, add any particular field you want, or parse in Cribl before sending to a destination.

    How was the initial setup?

    The initial setup involves dropping some events that are not required for security purpose monitoring. This is based on suggestions from our SOC team or customers.

    The deployment itself is a bit compicated and the documentation is not very clear.

    What about the implementation team?

    We are a partner with Cribl. We have CrowdStrike, and CrowdStrike has partnered with Cribl; they even changed the name to CrowdStream.

    What was our ROI?

    It has saved my cost and our customers' cost drastically since I cannot drop the logs directly in SIEM. In Cribl, I can drop the logs, and when I'm not ingesting them, their licensing cost is drastically reduced.

    What other advice do I have?

    Cribl Search is quite handy; you can use regex where there's a function that contains, and you can search for a specific keyword, which shows everything that matches that keyword. After playing around a couple of times, it becomes easy. At first, it is complicated; you need to go to worker groups, select the data lake, select the worker node. Once you get used to it, it's quite handy. I would definitely recommend Cribl to other users. 

    Based on my experience, I would rate Cribl eight out of ten.

    Which deployment model are you using for this solution?

    On-premises

    If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

    Google
    Joseph Bonadeo

    Runs smoothly and stands out with its well-organized user interface

    Reviewed on Sep 17, 2025
    Review from a verified AWS customer

    What is our primary use case?

    Our use case for Cribl  is that we want to make sure that we parse everything correctly, and it is easier for us to transfer our data in our system in a more compact way; it runs smoothly.

    How has it helped my organization?

    We're in the beginning stage of using Cribl, but the reduction in firewall logs will help significantly with processing speed. We just worked on handling high volumes of diverse data including logs, metrics, and files last week, and it ran very smoothly with quick processing.

    What is most valuable?

    The best feature about Cribl  is how easy it is to move; the UI is very simple, everything is very neat, and everything is organized. We have been dealing with Cribl extensively recently.

    What needs improvement?

    Cribl is awesome. The university offers a lot of great resources, but there could be more detailed information about Cribl itself. It would be helpful to have a step-by-step guide that covers everything from the basics. Since Cribl is such a large platform with numerous features, having a clear, structured approach would make it easier for me and others to understand and utilize its capabilities.

    I believe it would be beneficial to have a step-by-step guide for users on our endpoint. This would make it easier for them to understand how to use it. When I explored the endpoint, I found myself wishing for clearer instructions presented in a sequential manner. This is just a small critique based on my experience using it so far.

    For how long have I used the solution?

    We started using Cribl around three months ago.

    What do I think about the stability of the solution?

    I would rate stability as a nine; nothing is perfect, but it's great. 

    What do I think about the scalability of the solution?

    I would definitely give scalability a nine as in terms of what we're seeing and thinking about, it's solid.

    We have around eight or nine users. Everyone is touching base with it. For now, it will stay at eight unless we expand. We are going through an expansion, so it’s possible we might increase the number of users; but for now, we’re steady at our current count. We are a medium-sized business.

    How are customer service and support?

    Their customer support is fantastic.

    How would you rate customer service and support?

    Positive

    Which solution did I use previously and why did I switch?

    We were using a manual solution previously; this transition to Cribl is our first time implementing an automated solution.

    How was the initial setup?

    We are typically on-premises. I believe Cribl is currently focused more on the OT side because the primary customer base is more enterprise-oriented. OT relies heavily on this. However, if I'm not mistaken, we operate in an on-premises or hybrid environment; we are definitely not using the cloud.

    We are still in the process of deployment, and so far, the deployment has been going fairly well and has been relatively quick for us.

    We are in the transitioning stage; we're implementing everything from square one with our team, participating in daily calls to make that happen. We are experiencing some issues with data transfer and parsing errors, which is extending our SIEM  transfer time.

    What was our ROI?

    Based on what our managers say, we have saved a significant amount of time and resources moving from a manual approach to something that's more automated.

    Which other solutions did I evaluate?

    As I visited different booths at the conference, I realized that I still prefer Cribl. Even though I haven't worked with any other platforms, I was impressed by how everything is laid out and how simple it feels to work with your system. I genuinely appreciate the user interface. I find it straightforward and well-organized, making it easy to navigate.

    I also noticed that they have implemented something like a password manager, which sounded familiar. Overall, everything I saw reaffirmed my preference for Cribl. So, despite checking out various booths, I'm still committed to Cribl at the end of the day.

    What other advice do I have?

    I would definitely recommend it. The user interface is great, and the customer support has been fantastic as well. Our experience with Cribl has been very smooth; everything runs seamlessly. There are no delays or sluggishness, which I really appreciate. I have to give it props for that; everything operates very smoothly.

    I would rate Cribl a nine out of ten.

    Abdullah Zubair

    Enables seamless SIEM/Data Migration and Log Filtration across the enterprise estate

    Reviewed on Sep 09, 2025
    Review provided by PeerSpot

    What is our primary use case?

    Our main use case for Cribl  was SIEM  migration, where we merged multiple SIEM  solutions to a single SIEM solution. SIEM migration was the most major use case we were looking for. The second use case was a manageable logging solution which could have a nice interface and would be easy to manage. Data cutoff or Log Filtering was the third biggest use case we were looking for, where we were seeking data reduction to define what we need and don't need. Additionally, we performed data masking for PII i.e. payments and medical data. These were the main use cases that were all provided by Cribl .

    How has it helped my organization?

    My previous company did a significant amount of business using Cribl, particularly in servicing customers who had a perfect fit for the solution. From a consultant's perspective, I can say that we resold licenses for Cribl, delivered services related to Cribl, and also provided maintenance services. This brought a decent amount of business to our company.

    Regarding the reduction in firewall logs due to Cribl, it did influence our overall data processing and workflow. For example, the AWS  VPC flow logs were greatly reduced in size, which had a substantial impact on the licensing costs for destination platforms. It did help us and the customer quite a bit. Cribl's role in its reduction of firewall logs, either cloud or on-prem, was vital.

    The data cost is an important aspect. Cribl is specifically designed to reduce the data costs associated with the destination platform. This is one of its core offerings.

    Regarding platform usability, the Cribl interface is quite intuitive and easy to use. The navigation and seperate sections are easily accessible, making it very user-friendly. The color scheme and palette are excellent, and there’s nothing messy or unmanaged about the user interface. Overall, I personally find the user interface to be very comforting.

    What is most valuable?

    The features of Cribl I have found most valuable include its SIEM migration capability. It facilitates migration quite nicely. The data reduction and preprocessing capabilities make Cribl really unique. Data masking is an important one. And as Cribl Stream  can be deployed on-prem, on cloud or as a hybrid model, its support for every sort of enterprise estate is highly appreciated.  

    The UI interface is very good. It's user-friendly, intuitive, not complicated, and sufficient. It's not more than what it needs to be, and it's simple without being overly complicated.

    What needs improvement?

    They've already done many good things with the product, but perhaps they could implement a temporary SIEM solution where we could store logs and display them as a SIEM, though I think that's not the space that Cribl is actually looking into. Based on my experience, this product is brilliant and there isn't much or anything important lacking in the product.

    We encountered some occasional issues with the syslog data stream, particularly when handling large data volume, and getting it to parse and field extracted correctly, but no major alarms that would halt the days operation. There were few source vendor specific challenges, but overall, I didn't notice anything major beyond that. Most of the process went smoothly. However, we did need to carry some troubleshooting to resolve the issues we faced while connecting with other platforms and few data stream miss-behaving, which wasn't a straightforward task for us. In terms of large datasets—whether they originated from network inputs, virtual machines, or cloud instances—ingesting the data into the destination was relatively easy. In summary, aside from the usual difficulties or issues that someone could face with any project, everything else went well.

    For how long have I used the solution?

    I have been working with Cribl for more than four years now.

    What do I think about the stability of the solution?

    Cribl is quite stable and doesn't crash; there's no unusual behavior. If it's stable, then it's reliable. I could see the data that goes in and how it is being processed at each stage. There are no concerns when Cribl is working in production environment.

    What do I think about the scalability of the solution?

    Cribl is quite scalable, as we could add worker nodes as our data grows, so it's sufficiently scalable and able to facilitate as much data as there can be.

    How are customer service and support?

    Their technical support has been really great, and solution architects we worked with were really knowledgeable. They had extensive expertise with the product and were able to facilitate with everything we needed. The experience with Cribl technical staff has been one of the best.

    How would you rate customer service and support?

    Positive

    Which solution did I use previously and why did I switch?

    For similar use cases, different companies were using different tactical solutions i.e. custom scripting. None of the solutions were strategic and well thought through. Some were using scripting, some were not utilizing anything. Some were ingesting into the SIEM and then doing all the tasks which should be done pre-ingestion. There was a lot of disorganization, and Cribl had really found the gap where they could offer their services.

    How was the initial setup?

    I performed the entire setup of the Cribl infrastructure.

    With the Cribl Stream setup, I first had to initiate the tenant. Once the tenant was provisioned, I configured IAM  setup i.e SSO , RBAC etc. I onboarded the data sources and deployed the worker nodes to the appropriate locations. These locations could be various subnets, cloud virtual machines, on-premises virtual machines, or any ready-to-use Cribl cloud workers  we needed. The process depended on the company's IT infrastructure. After the worker nodes were set up, it was simply a matter of onboarding the data stream into the platform and then directing it to the destination platforms.

    As for Cribl's deployment, it operates in a hybrid environment, utilizing both cloud and on-premises solutions, tailored to meet the needs of different customers.

    What about the implementation team?

    I delivered Cribl services as a Certified Cribl Consultant to various customers. Cribl technical support was arranged whenever there was a need for it.

    What was our ROI?

    We have managed to save significant money and resources for multiple customers, reducing operational complexity and the cost of destination platforms but unfortunately I cannot quote specific numbers due to NDA. 

    What's my experience with pricing, setup cost, and licensing?

    Cribl is very inexpensive, with enterprise pricing around 30 cents per GB, which is really decent. Organizations looking to ingest terabytes or petabytes of data each day find it quite an inexpensive solution. The pricing model for Cribl Stream  is one of the best values that customers would be getting, and I don't think any other solution offers this much value at this price point.

    Which other solutions did I evaluate?

    Confluent  was considered, but Cribl emerged as the best solution.

    What other advice do I have?

    I would rate Cribl an eight out of ten.

    Which deployment model are you using for this solution?

    Hybrid Cloud

    If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

    Joe Cicero

    Facilitates seamless log integration and reduces data costs with efficient compression

    Reviewed on Aug 15, 2025
    Review provided by PeerSpot

    What is our primary use case?

    I use Cribl  with all of my customers that I manage services for. It's how I get their third-party log sources into Microsoft Sentinel .

    How has it helped my organization?

    We save about 75% percent of our costs by processing network and firewall logs through Cribl. This is largely due to the compression and duplication that exists within those logs. They tend to be very noisy, and most of the information isn’t useful from a security standpoint. While some of the data might be valuable to other departments, we don’t need to store all that extra information. By removing these unnecessary details, we quickly reduce our data retention costs by 75%.

    Cribl makes it very easy to contain data cost and complexity. As far as complexity is concerned, there might be manual ways to do it in other products, but not with the ease and durability. It remains the same, whereas you might try to put a patchwork of other things together to get the same result. In terms of controlling costs, we achieve about 75% savings on data storage, which is fantastic. However, it’s worth noting that Cribl is not free, so we do pay for it to realize these savings. As long as Cribl doesn’t increase their prices too steeply or too quickly, we should be fine in terms of managing our costs.

    Cribl definitely handles high volumes of diverse data types. Anything from firewall logs, endpoint security logs, to Windows event logs can become very noisy, especially in large environments. I've not had an issue with Cribl dropping logs. Occasionally there could be a short-term outage, but that's definitely very rare.

    What is most valuable?

    My favorite feature is Cribl  Stream . That's probably the only Cribl product I have a lot of experience with, and Cribl Stream  makes it very easy to identify where all the customer's log sources are and to quickly connect them to a destination source such as Microsoft Sentinel  and Microsoft Azure  Data Storage.

    Cribl Stream does two things: not only does it make it easy to connect one log source or one dataset to multiple storage locations, but it also has compression features, which greatly reduce the storage cost for that data. It strips out and compresses data so that only the absolute information remains and not any duplicates. Dual destination and compression are the two top features.

    What needs improvement?

    I would Cribl to become more Microsoft-focused. A lot of my work is in the Microsoft environment. Cribl supports all of these other platforms out there, and they seem to be developing a lot for CrowdStrike. I'd prefer to see some Microsoft-specific connectors built inside of Cribl.

    For how long have I used the solution?

    I have been using Cribl for about two years now. They've only been around for about four years, so I've been using them for half of their existence.

    What do I think about the stability of the solution?

    The performance and stability of Cribl are fantastic. The uptime is 99.9%. We are realizing all of the cost savings promised, and there are no failures.

    What do I think about the scalability of the solution?

    Scalability is easy because we can just go into the portal and add a new log source. If we onboard a new firewall or something we want to collect logs on, we can quickly implement that. I don't need to talk to a Cribl engineer to connect a new log source. The only requirement might be purchasing more Cribl credits if I'm running low because I'm asking it to do more than originally specified.

    How are customer service and support?

    We've engaged their customer service and support, and anytime there's an outage, they've been very receptive. They've quickly escalated our tickets and helped us get resolution. We've never felt we were waiting for a response or that they didn't know what was going on. I think it's maybe because we were an early customer. I would assume it's the same for all customers, but we've gotten great treatment. 

    I would give them a 10 out of 10 for support. They are very responsive. We deal with a lot of other cloud solution providers who have tried to save money on support. It could be that because Cribl is new and they really want to make sure all new customers are being successful, but we really hope this continues. We don't feel we're alone.

    How would you rate customer service and support?

    Which solution did I use previously and why did I switch?

    The only alternative I can compare Cribl to would be Azure  Data Transformation, Azure Data Time configuration rules and policies, basically making the storage source sort the data, and that is very painful. I don't see any next-best options when it comes to Cribl. They seem to be a leader and standing alone in their service offering, specific to Cribl Stream. For other products such as Cribl Lake, there's now Microsoft Sentinel Lake, which is a competitor, and I haven't really analyzed the pricing to see how competitive that is. But regarding Cribl Stream, there's no close competitor. The closest is extremely painful, requiring about 20 pages of configuration to even get close.

    How was the initial setup?

    It's straightforward. They have a really nice user interface, and their service engineers will guide you through the initial setup. Since they are compensated based on product usage, they ensure that we are properly onboarded and that our experience is as successful as possible.

    To deploy Cribl probably took an hour. Identifying all the different log sources that we wanted to bring in took about another eight hours of human work as it was a data exercise of determining which log sources are important to us, and where we can get the best compression or data size reduction. You can connect to them all automatically, but you want to have the thought process of which ones matter and what actual data you need. 

    It does not require any maintenance on my end. The big thing is just checking connector health to make sure everything is running and that logs aren't dropping and that there haven't been any changes. In case there's any outage, putting in a ticket for any outage issues is very minimal. It's set it and forget it, and then just monitor to make sure nothing's bad or nothing has gone wrong.

    What about the implementation team?

    We're a large organization, so we have a team of about five people who worked on the deployment of Cribl. I'm sure smaller organizations could use a lot less. We probably could have gotten away with two or three people. Not to say one person couldn't do it, but it's always good to have another person putting eyes on the process just so that we don't have a single point of failure.

    What's my experience with pricing, setup cost, and licensing?

    The pricing has been increasing year-over-year, and I understand that the cost of business continues to grow. The cost of log retention and all the aspects they're fighting against, they are also a victim of. It is a concern that I'm watching as they raise prices about 10% year-over-year. I am still observing significant cost savings, although the amount of savings is gradually decreasing. Additionally, they are currently the sole provider of this type of solution, which means they face no competitive threats.

    What other advice do I have?

    I would rate Cribl a ten out of ten. I truly appreciate them as partners. They genuinely feel like they're with us on this journey to manage the increasing volume of data. It's been exciting to watch them grow. At first, I thought I was a bit of a nerd for being an early adopter, but seeing so many others come on board after us reassures me that we made the right decision.

    View all reviews