Cribl
Making Observability Viable for Every Organization

Exabeam and Cribl Announce Strategic Partnership to Accelerate Threat Detection, Investigation, and Response

Wednesday, August 16, 2023

New partnership gives enterprises more control over their data, accelerates SIEM deployments, and mitigates risk

FOSTER CITY - Exabeam, a global cybersecurity leader and creator of New-Scale SIEM™ for advancing security operations, and Cribl, the data company for IT and Security, today announced a new strategic partnership. The partnership enables New-Scale SIEM to more quickly and securely ingest data for enterprises and accelerate deployment. With a shared mission to empower security teams to seamlessly integrate the right data at scale, the Exabeam and Cribl partnership can enable enterprises to better manage high volumes of data, effectively secure their environments, and ultimately help reduce risk and cost.

“Leveraging Cribl and Exabeam together has made onboarding new data sources faster and less complex, allowing us to focus engineering efforts on more critical business needs,” said Michael Meis, Associate Chief Information Security Officer, University of Kansas Health System. “We can filter out lower value data and make room for the right data sources to increase visibility. Using Cribl Stream, we are able to control data quality and maximize the value of our Exabeam implementation.”

The Exabeam cloud-native New-Scale SIEM offers rapid data ingestion, hyper-fast query performance, powerful behavioral analytics, and an automated investigation experience. With Cribl Stream, security teams also gain additional control over telemetry data and the flexibility to shape logs from multiple sources. Exabeam and Cribl are working together to address the challenges of routing, filtering, and masking data that can hinder or delay security investigations, hamper new technology adoption, and degrade regulatory compliance.

“We are incredibly excited to be partnering with one of the fastest-growing players in security and IT data. Successful companies collaborate to make their customers even more successful, and this is just one of the many ways that Cribl and Exabeam will continue to bring new, innovative solutions to market,” said Chris Cesio, CRO, Exabeam. “Moving to cloud-native SIEM or deploying a new SIEM in any organization can be a massive endeavor. Among other considerations, it requires security and IT teams to take a hard look at the data they need to ensure continuous and advanced threat detection, investigation, and response (TDIR) capabilities.”

“Cribl and Exabeam have a shared understanding of the many challenges IT and security teams are facing today,” said Matt Bauer, SVP of Global Sales, Cribl. “Customers deserve to quickly realize the full potential of their investments, but being able to cost-effectively manage massive amounts of data while keeping the organization secure is no easy feat. This new partnership will lighten the load for many of our customers by enhancing data ingestion, lowering storage costs, and speeding up time to value.”

Sending Data to Elastic Security With Cribl Stream (And Making It Work With Elastic SIEM)

Saturday, December 09, 2023

Cribl Stream is a real-time security and observability data processing pipeline that can be used to collect, transform, enrich, reduce, redact, and route data from a variety of sources to a variety of destinations. One of the popular destinations for Cribl users is Elastic SIEM. This blog post will walk you through the steps on how to set up Cribl Stream to normalize and forward data to use with Elastic Security for SIEM.

Step 1: Getting Data Flowing

Configure Your Elastic Destination

To configure your Elastic Cloud or Elasticsearch destination, go to Data > Destinations in the Cribl Stream user interface. Then, select Elastic Cloud or Elasticsearch (docs page) and click Add Destination.

In the New Destination window, enter a unique name for your destination and your Elastic Cloud ID. You can also optionally send to the Bulk API and even enable load balancing by specifying multiple Bulk API URLs if you are using the Elasticsearch destination.

Step 2: Getting Data into Elastic Security

Elastic Security is an excellent SIEM designed to help you protect, investigate, and respond to cyber threats quickly and at scale. Underneath all this functionality lies your data, but as searching and correlating across multiple datasets and data schemas can be challenging, Elastic created the Elastic Common Schema (ECS) to normalize events and metrics. ECS simplifies searching, correlating, and analyzing events across various sources. this section will guide you through the process of ensuring your data is in ECS format so you can make the most of Elastic Security’s capabilities.

There are three ways to get data into ECS format and ready for Elastic Security.

1. Use a pack that supports converting events into ECS

2. Map your events into ECS format manually

3. Send the original event into Elastic pipelines

We’re going about it in this order because as long as you perform the mapping in Cribl Stream, you can still clean and transform your data as you wish. Having Elastic map your events will require you to send the original log. So, without any more delay, let’s dig into each of these.

Mapping to ECS via Packs

Some packs in the Cribl Pack Dispensary support mapping data into ECS format. In most cases, this should be fairly straightforward to enable this feature: likely, you will need to enable a group of functions inside the pipelines of the pack in question. The following packs support ECS conversion today:

• Cisco ASA

• Cisco FTD

• Corelight Pack

• Zscaler

• …and several more on the way!

Mapping to ECS Manually

If you want to map data manually to ECS, there are a few things you should do first to make this effort much more straightforward.

• Look over the ECS reference docs and get a general understanding of how the schema works.

• Install one of the packs listed above and see how the ECS functions to convert the events.

• Do a little web searching to see if the vendor of your data has guidance on how to map into ECS.

1. Elastic GitHub with raw data samples mapped to ECS

2. Elastic Docs pages for specific datasets

• Check out this webinar from Elastic for some guidance on integrating custom logs with ECS and Elastic SIEM.

Once you’ve done all three steps, you can map your dataset into ECS. As for performing the mapping, you can take a few different approaches to accomplish this. Today, I will show you one way to approach this. But my next blog post will detail several other methods and the pros and cons of each.

Cribl Announces Strategic Partnership with Elastic to Drive Greater Data Flexibility

Thursday, December 14, 2023

SAN FRANCISCO, -- Cribl, the data engine for IT and Security, today announced a new strategic partnership with Elastic, the company behind Elasticsearch®, to provide customers with greater data flexibility, delivering enhanced data visibility, improved SIEM capabilities, and simplified migrations to Elastic Cloud. The new partnership brings a deeper integration between the full Cribl suite of products and Elastic Security and Observability, enabling customers to more efficiently manage and operationalize their data. Additional Cribl Packs will be available to provide customers with out-of-the-box content that maps common log types to Elastic Common Schema (ECS), and in-product tiles will also be available alongside other pre-built integrations.

“Cribl gives us the flexibility and control we need to affordably manage and analyze our IT and security data in the face of rapid data growth,” said Brian Emmons, Senior Manager, IT Operations at Acxiom. “Cribl has allowed us to optimize and update our syslog infrastructure to easily collaborate with Elastic to boost our security posture, our engineers' productivity, future-proof our data architecture, and adapt with the changing needs of our business.”

As data grows at a 28% compound annual growth rate1, effectively managing data is increasingly more challenging for many organizations, with limited access to the real-time data required to inform business decisions. Cribl and Elastic together give customers a streamlined data management experience, with capabilities including:

• Enhanced data visibility with the power of Cribl’s pre-processing capabilities and Elastic’s real-time AI search analytics solutions for Observability, Security and Search, to tap into clear and concise data insights.

• Improved SIEM capabilities to enhance and accelerate incident response with streamlined data processing tools.

• Simplified migrations for cloud deployments, on-prem to cloud migrations, and SIEM migrations.

Additional customer benefits include enhancing Elastic’s search analytics capabilities with optimized data input, ensuring data meets regulatory standards throughout its lifecycle, and lowering operational costs through more efficient data processing.



1 IDC, Worldwide IDC Global DataSphere Forecast, 2023-2027: It’s a Distributed, Diverse, and Dynamic (3D) DataSphere

"Getting the right data into the right tools, and doing that efficiently, is at the core of what we do for our customers. This new partnership with Elastic brings stronger interoperability between our product suites and enables customers to do more with their data," said Zac Kilpatrick, Vice President of Global Channels & Alliances at Cribl. "Cribl enhances on-prem and cloud migration process to Elastic Security and Observability. By helping customers transition from existing onboarding systems, we improve the management and control of enterprise logging and security pipelines. There’s massive value here for our customers, and we’re excited to work together to help customers realize the full power of their data."

“Customers need visibility into their security and observability logging pipelines. Combining the unified Security and Observability capabilities of Elastic with Cribl’s data ingest, transformation, and routing features offered by Cribl brings a whole new level of flexibility to our clients — making it easier than ever to integrate and manage existing enterprise logging pipelines. Cribl’s use of the Elastic Common Schema will provide our customers with industry-leading flexibility to ingest, normalize, and manage the largest and most complicated security and observability pipelines,” said Laurent Mechain, Vice President of Strategic Alliances at Elastic.

In partnership with Cribl, Elastic is enhancing the OpenTelemetry (OTel) data integration process. This joint solution streamlines the transfer of OTel data into Elastic and builds on Elastic’s contribution of ECS to the OTel project earlier this year, which enables a unified specification for security and observability data within the OTel Semantic Conventions framework. The collaboration between Elastic and Cribl marks a significant advancement in the efficient and coherent management of security and observability data.

Cribl Achieves ISO 27001 Certification for Information Security Management

Thursday, December 14, 2023

Data company’s suite of products meets rigorous security standards, ensuring the highest level of data security for customers and partners globally

SAN FRANCISCO - Cribl, announced it has received the ISO 27001 certification for its Information Security Management System (ISMS), ensuring its suite of products meets the highest standard of data security for global customers and partners. This certification further strengthens Cribl’s commitment to security and compliance, building on its previous completion of the SOC 2 Type II attestation and its ongoing commitment to global data privacy regulations like the European Union’s General Data Protection Regulation.

ISO 27001 is a globally recognized information security management system standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Cribl’s certification was issued by A-LIGN, an independent and accredited certification body based in the United States, upon the company’s successful completion of a formal audit process.

“Cribl is committed to providing organizations with choice and control over their data, and part of that control is ensuring the highest level of security for our customers and partners,” said Matthew Kelly, Chief Legal Officer at Cribl. “This certification reaffirms our commitment to maintaining the highest standards of information security across our entire suite of products, and we look forward to continuing to deliver innovative, best-in-class solutions that give customers the flexibility and control to safely unlock the full value of their data.”

Compliance with this internationally recognized standard demonstrates Cribl’s security management program is comprehensive and follows leading practices. The scope of its ISO 27001 certification includes the controls, activities, systems, and policies associated with development and support of Cribl Stream, Cribl Edge, and Cribl Search, as well as Cribl hosted and managed solutions accessed via Cribl.Cloud.

Cribl Secures $150M in Series D Funding and Introduces Cribl Search To Unlock Value of All Observability Data

Thursday, June 13, 2024

Continuing its rapid business momentum, Cribl is unveiling a bold vision for the future of observability and expanding its product portfolio

SAN FRANCISCO, -- Cribl, the leader in enabling open observability, today announced it raised $150 million in Series D funding led by Tiger Global Management, and joined by existing investors IVP, CRV, Redpoint Ventures, Sequoia, and Greylock. Secured less than a year after its Series C round last summer, the Series D funding brings Cribl's total funding to $400 million, validating the growing role observability data plays in driving business outcomes.

As the company continues to expand its product portfolio and serve a more diverse set of global enterprises, Cribl also today announced a bold new vision to advance the category of observability with the introduction of Cribl Search, the first open and vendor-agnostic analytics tool to perform "search-in-place" queries. Cribl Search will usher in a new era of convergence between observability and security operations by enabling queries on any data, in any format, at any location, furthering the company's mission of creating an open ecosystem of data. For the first time, security and IT operations can keep up with the explosion of telemetry data and eliminate blind spots in data operations without slowing the productivity of their limited resources.

"Five years ago, we started Cribl to help IT and security practitioners unlock the full power of observability," said Clint Sharp, CEO and Co-Founder of Cribl. "As our company continues to grow and innovate, we see an even broader mission: to chart the future of the observability category. With this new funding helping us build toward Cribl Search and beyond, we look forward to breaking down the barriers to entry that challenge many organizations' observability practices and giving our customers the choice and control they need to leverage observability to both improve IT operations and drive business outcomes."

John Curtius, Partner at Tiger Global, said "Tiger Global has a history of backing forward-looking category leaders who are tackling massive market opportunities. We're proud to partner with Cribl as it continues its remarkable trajectory of product innovation and customer-centricity."

Cribl Search, the first innovation driven by Cribl's newly formed Cribl Zero2One (C021) perpetual innovation lab, eliminates the cost and complexity that legacy search technologies impose, as it does not require teams to ingest, ship, and centrally store telemetry data for analysis. Built on a foundation of Cribl Stream and Cribl Edge, Cribl Search performs "search-in-place" queries on any data, in any format, at any location -- at the edge through Cribl Edge, in flight through Cribl Stream, in an organization's observability lake, or even within existing systems, vastly increasing the scope of analysis. Cribl Search also complements and enriches the capabilities of existing systems, helping maximize investments and providing organizations with the choice of how to best conduct analysis.

"Cribl is taking an innovative approach to modernizing the search experience for cybersecurity and operations teams," said Chris DePuy, Technology Analyst and Founder of 650 Group. "By making data discoverable and searchable without having to first move it, Cribl Search offers the broadest visibility and accelerates troubleshooting, security investigations, and operational efficiencies while still giving its customers choice and control over how they use their observability data."

Cribl Closes $319M Series E Funding at $3.5 Billion Valuation

Friday, August 30, 2024

Cribl, a San Francisco, CA-based data engine company for IT and security, raised $319M in Series E funding, at $3.5 Billion valuation.


The round was led by GV (Google Ventures) with participation from GIC, CapitalG, IVP, and CRV. GV’s General Partner and former GitLab CRO Michael McBride joined Cribl’s Board of Directors.


The company intends to use the funds to accelerate its continued growth by accelerating product development, extending global presence, and strengthening infrastructure to support its rapid expansion.


Founded in 2018 and led by Clint Sharp, CEO, Cribl is a data engine company for IT and security that empowers organizations to to analyze, collect, process, and route all IT and security data from any source or to any destination, delivering the control, and flexibility required to adapt to their needs. Its product suite, which is used by Fortune 1000 companies globally, is purpose-built for IT and Security, including Cribl Stream, an observability pipeline, Cribl Edge, an intelligent vendor-neutral agent, Cribl Search, the industry’s first search-in-place solution, and Cribl Lake, a data lake.

Cribl Closes $319 Million Series E at $3.5 Billion Valuation to Revolutionize the Enterprise Data Market

Wednesday, September 04, 2024

Rapid customer adoption of vendor-agnostic data management drives oversubscribed Series E round led by GV (Google Ventures), including General Partner and former GitLab CRO Michael McBride who joins Cribl’s Board of Directors

SAN FRANCISCO-- Cribl, the Data Engine for IT and Security, today announced it has closed a $319 million oversubscribed Series E round, comprised of a combined primary and secondary transaction, bringing the company’s total capital secured to over $600 million and increasing its valuation to $3.5 billion, up 40% since the company’s Series D round in 2022.

The round was led by new investor GV (Google Ventures), marking one of the firm’s largest-ever investments. The investment was led by GV General Partner and former GitLab CRO Michael McBride, who joined Cribl’s Board of Directors. GIC, CapitalG, IVP, and CRV also participated in the round. This funding comes on the heels of Cribl surpassing $100 million in annual recurring revenue (ARR) in less than four years, becoming the fourth-fastest infrastructure company to reach centaur status in October 2023.

As enterprise data grows at a 28% CAGR, far outpacing IT budget growth, legacy vendors and point solutions make it challenging for customers to keep up with the volume, variety, and value of data. Cribl's vendor-agnostic solutions empower customers to analyze, collect, process, and route all IT and security data to unlock its value. Since its inception in 2018, Cribl has seen unparalleled growth as enterprises around the world rapidly adopt the Data Engine for IT and Security to transform their data strategies. Cribl’s telemetry data management solutions drive significant value for enterprises, evidenced by:

● ARR Growth: The company’s ARR has grown at a 163% CAGR for the last four years;

● Customer Growth: The customer base has grown by triple digits YoY for five straight years, including a quarter of the Fortune 500 companies that are now Cribl customers;

● NDR: Customers continue to grow and expand with Cribl as the company boasts a net dollar retention (NDR) of over 130% over the past 12 months;

● Multi-product Adoption: Customers purchasing multiple products across the portfolio increased by over 300% over the past 12 months.

"As practitioners who worked in this space for years, my co-founders and I know firsthand the challenges facing IT and Security as data grows exponentially. What worked over the last ten years simply cannot keep up with the needs of businesses today, let alone over the next ten years," said Clint Sharp, co-founder and CEO of Cribl. "We started Cribl to solve these real problems for real users. Today's funding proves the value in that approach. It's an incredible milestone, but only a step in our journey to create a generational company that will continue to evolve to meet our customers' needs."

“At Sophos, we’ve found Cribl to be invaluable when it comes to addressing some of our most complex data processing challenges. Cribl not only understands the unique needs of cybersecurity professionals but also empowers them with great flexibility and control over their data. Cribl also enables us to tailor data formats for different destinations, giving us much greater control over storage options and retention periods,” said Stephen O’Leary, Principal Information Security Engineer at Sophos. “This flexibility complements our own products and other tooling, allowing us to efficiently manage an ever-increasing volume of data from disparate sources. More than just a vendor, Cribl has become a key collaborator in our mission to protect Sophos.”

GV’s support of Cribl is significant, marking one of the largest investments in the firm's 15-year history. The funding will facilitate Cribl’s continued growth by accelerating product development, extending global presence, and strengthening infrastructure to support its rapid expansion.

“Every company must modernize its data stack as legacy systems already can’t handle today’s rapid data growth, and the arrival of AI further accelerates the need for a modern data platform,” said GV General Partner Michael McBride. “Cribl’s rapid growth has come from the consistent and powerful results experienced by its customers. It’s an honor to partner with Cribl’s deeply technical and seasoned team as they define the data platform category, similar to the way Salesforce did for sales and marketing and GitLab did for DevSecOps.”

With more than 700 employees worldwide, Cribl is actively broadening its business footprint, with a presence in the US, Europe, and Australia. The company’s market impact has been recognized by several prestigious industry accolades, including the Forbes Cloud 100 for two consecutive years, the Redpoint InfraRed 100, Notable Capital’s Rising in Cyber, and the Wing Enterprise Tech 30.

Read more about the news on Cribl co-founder and Clint Sharp’s blog.