Community Discussions

Hello everyone! I’m quite new to Cribl, but I’ve spent about 10-20 hours so far reading the documentation. I’d like to send Windows event logs from on-prem servers and workstations to Azure Storage with the sort of parsing/normalisation that you’d have from Azure Monitor Agent (such as the SecurityEvent and WindowsEvent structures). This isn’t directly possible with Azure Monitor Agent and the AgentDirectToStore kind in Data Collection Rules (only Azure VMs are supported). I’m hoping that one of the Cribl products can help me with this. I looked at the Sentinel pack, and it appears to only support forwarding data to Sentinel. Is there an existing solution for mapping/normalisation/transformation (I’m not sure which term(s) are appropriate here: pipelines are so complicated!)? My environment has a lot of events across many log providers, and I’m also not sure what kind of magic that Azure Monitor Agent does to events (ie, is it just changing field names? Does it enrich

Hi All i am migrating some sources from source →lb → syslog →  splunk to source → lb → cribl → splunk I am seeing few big events landing on plunk via syslog but the same event when i search on cribl syslog source the events are not visible at all can anybody suggest if there are any setting at cribl that can cause this drop.

Hello.  I am a total newb with API integrations and was hoping for someone to help me set up an integration between Delinea and Cribl.  I again am totally new at this and just dabbled at a couple of Cribl University courses but I need to get on the fast lane.  Is there anyone that has done this already than can walk me through this configuration.  If there is any additional details needed to clarify please let me know. So far in the Delinea platform I have followed their instructions and enabled the Syslog/CEF Logging option.  As for the entries I had to enter into the field I’m not sure if I did this right.On the Cribl side I tried setting up a Syslog Source but not sure what to enter into the field either.Hope someone can assist.Thanks!

i have corelight events which  has id.orig_h ,id.resp_h etc fields , but when i try to rename them using eval src_ip=id.orig_h… it doesnt work , the RENAME fucntion works though, I dont want to use rename because i dont want to lose original fields , i also cant use corelight pack because it is also using rename , how can i rename without losing original field???

Hey folks! I’ve been tinkering away and ended up building a couple of Ansible Collections for Cribl - mostly focused on Stream and Edge. Since everything is generated from the OpenAPI spec, you’ll also find modules for Lake and Search in there. Those aren’t fully battle-tested yet, but they’re along for the ride. The collections include both declarative/idempotent modules and more imperative ones, depending on how hands-on you want to be. They also support both on-prem username/password auth and client-ID/secret for Cribl Cloud. If you want to poke around, try things out, or throw tomatoes at my code, the repo’s here:AlexAsplund/ansible-collections-criblCurious to hear what people think or how you might want to use it next.

how can i setup cribl hec source or the splunkhec destination to drop data older than 24hrs ?

Has anyone been able to Ingest Proofpoint CASB and TAP ATO (Account Takeover) logs into Stream? I do not see a collector available for these. Proofpoint sent me some API specs for their endpoint but I’m stuck.Proofpoint CASB and TAP ATOAPI GuideVersion 4.04(US)December 2023This document describes the API methods provided by the Proofpoint CASB platform for retrieving various data entities. The guide includes details on how to use the Proofpoint CASB APIs to retrieve system events and their corresponding alerts.https://proofpoint.my.salesforce.com/sfc/p/#3000000006Bs/a/Uy000000gPbV/QnJwgeOF_q4XsxQYmHUkAl_HzPSl08BxnGpQsEVVS8o

We are planning to integrate SailPoint log with Cribl and send to Cribl lake. Is there any specific Cribl doc for the same? Or anyone has done this integration in the past?

The first step in setting up SSO is to make a ‘backup access’ account with an email NOT in the domain being SSO’d. Can anyone say if this needs to be a working account or is it just a Cribl-specific username/password which doesn’t need to receive emails?

I am running Cribl version 4.12 and I am trying to collect Qualys detection logs using “qualys-detections” script by Jon Rust but it does not seems to be working.My Qualys login is working on EU1 platform "https://qualysapi.qualys.eu", the required python3 and env are set Here is the “qualys-detections” script --------------------------------------------------------------------------------------------- #!/usr/bin/python3import sysimport requestsimport reimport osfrom pprint import pprintfrom time import timefrom datetime import datetimedebug = Trueaction = ''APIURL = "https://qualysapi.qualys.eu"try:    API_USER = os.environ['CRIBL_username']    API_PWD = os.environ['CRIBL_password']    EARLIEST = os.environ['CRIBL_earliest']    MAX_RUN_COUNT = int(os.environ['CRIBL_max'])except:    print("CRIBL_username, CRIBL_password, CRIBL_max and CRIBL_earliest must be

I'm seeking assistance with connecting a Cribl Stream worker (running on a GCP VM) to our Cribl Cloud Leader. We are encountering a persistent connection handshake timeout error, despite extensive troubleshooting that indicates the network path through our corporate proxy is otherwise functional.Environment Details:Cribl Version: Latest (installed via install-worker.sh script) Worker OS: Ubuntu (GCP VM){"time":"2025-11-11T17:11:14.026Z","cid":"api","channel":"ProcessMetrics","level":"info","message":"stats","cpuPerc":0.69,"eluPerc":0.41,"mem":{"heap":108,"heapTotal":117,"ext":3,"rss":201,"buffers":0}}{"time":"2025-11-11T17:11:16.589Z","cid":"api","channel":"MetricsStore","level":"info","message":"active metrics","numMetrics":29}{"time":"2025-11-11T17:11:23.433Z","cid":"api","channel":"output:DistWorker","level":"warn","message":"sending is b

Hello,Am experiencing issue on cribl leader that no commits to be raised after any change I do. I wan not using any remote github and when I tried to change the settings in cribl to a current github repo, the git setting page gives me a gateway error and does not load at all   

I have verified that I can list the directories using the AWS CLI with the following command:aws s3 ls s3://cisco-managed-us-east-2/my_directory_prefix/I can pull the logs to my local directory using the following command:aws s3 sync s3://cisco-managed-us-east-2/my_directory_prefix/dnslogs/ C:\umbrella_logs\However, I am unable to pull them using the Umbrella S3 Collector in Cribl Stream locally hosted. Any ideas on what I could do differently?Here are my settings for the Cribl S3 collector with the personalized info redacted:{ "type": "collection", "ttl": "4h", "removeFields": [], "resumeOnBoot": false, "schedule": { "cronSchedule": "*/5 * * * *", "maxConcurrentRuns": 1, "skippable": true, "run": { "rescheduleDroppedTasks": true, "maxTaskReschedule": 1, "logLevel": "info", "jobTimeout": "0", "mode": "run", "timeRangeType": "relative", "timestampT

Every time we update openshift in azure, my cribl config is lost. since we have the free version, we cannot use git repository. would using persistent storage helps keep the config because the update process drains the node from the cluster and restart them on another node. I suspect this is why the config is not kept.

Can i install Cribl Edge on my worker nodes without any production impact. `I want to use Cribl  Edge to monitor my Cribl Workers and certain files

cisco_asa_cleanup pack is not working for me, now sure how to make it work , need help in utilizing it, sample logsOct 1 03:23:58 asa_server_ip %ASA-6-302014: Teardown TCP connection 39876417 for VTI-Murex-abc:xx.xx.xx.xx/443 to inside:xx.xx.xx.xx/44714 duration 0:00:00 bytes 9514 TCP FINs from inside 0 0Oct 2 06:51:58 asa_server_ip %ASA-6-302013: Built inbound TCP connection 39876427 for VTI-Murex-abc:xx.xx.xx.xx/34664 (x.x.x.x/34664) to inside:xx.xx.xx.xx/443 (x.x.x.x/443) -1 -1Oct 3 04:54:58 xx.xx.xx.xx %ASA-6-302013: Built outbound TCP connection 39876426 for VTI-Murex-abc:x.x.x.x/443 (xx.xx.xx.xx443) to inside:x.x.x.x./14326 (xx.xxx.xx.xx/14326) 1 5Oct 5 01:54:58 xx.xx.xx.xx %ASA-6-302020: Built inbound ICMP connection for faddr xx.xx.xx.xx/54615 gaddr x.x.x.x/0 laddr x.xx.x.xx/0 type 8 code 0 Internal-Data0/-1:RX[-1]Oct 15 07:54:58 xx.xx.xx.xx%ASA-6-106015: Deny TCP (no connection) from x.x.x.x/38492 to xxx.xx.xx.x/6425 flags ACK  on interface

Hi all i am trying to upload few packs into stream leader using files but getting below sample error Error while installing Pack file cribl-cisco-asa-cleanup-1.1.15 (1).crbl in Group: Dev-OP: failed to install: ENOENT: no such file or directory, open '/opt/cribl/state/packs/cribl-cisco-asa-cleanup.LtY1yaM.tmp/data/lookups/asa_drops.csv'. what does this error suggest we have already uploaded few which got uploaded. 

​Hi Team,I’m working on an SNMP trap pipeline where:Input event has fields like trap_name and trap_varbind_apSysMgmtTaskSuspend.I have a Lookup table that maps:trap_name → varbindname → Output_attribute_value.After Lookup, I want to create a new field dynamically:Field name = value of Output_attribute_value (e.g., id)Field value = value from the field referenced by varbindname (e.g., trap_varbind_apSysMgmtTaskSuspend).I tried using Eval with:JavaScript[Output_attribute_value] = get(__payload, varbindname)Show more lines…but got Unallowed assignment operator error.Then I tried a Code function: JavaScriptconst targetField = event.Output_attribute_value;const sourceField = event.varbindname; if (targetField && sourceField && event[sourceField]) {event[targetField] = event[sourceField];}Show more linesBut the new

Is there a way of directly integrating netskope with cribl using rest api’s without using s3 Buckets for transactional logs

Hi all, I just completed the Level 3 Prerequisite exam but I have a question.One of the questions was as follows:What would be the result of the Mask function with the following settings Match Regex =`(user_id=) (d+)" Replace Expression = C. Mask. random( ${g2}') on the event host=server. local user_id=12345?A)host=server. local aeQI9B) host=server. local user_id=fe8780bd8237b0388df7175034db75d6C) host=server. local user_id=aeQI9D) The event would remain unchanged because the Match Regex is invalid.I chose option D. But apparently this was the wrong answer. But I think it shouldn't be… Here is why.The event host=server.local user_id=12345….(user_id=) (d+) matches “user_ID=”(d+) is incorrect, d is just a literal d and not a digit in this case, it should have been \d+. There is also a space in the regex, but the event itself does not have a space. “user_id=12345”This is why the event would remain

We would like to stream data into RDBMS, but we don’t see the option rdbms destination. How can this be achieved?

Previews of our new Terraform provider and SDKs are ready for you to explore!Check out the details on the Cribl as Code page.Kick the tires and tell us what you think!

HI all  I am trying to create a pipeline where all syslog data will land and i want to filter the events from device i want based on a string in _raw filed like firewall or any other unique string.i have tried _raw.includes(‘Firewall’) or /Firewall/ though when i  check in advanced mode in filter tab it matches the correct event but when i am checking it on a sample log i have built for testing it passes all the events regardless of filter.I know this can be done in routes itself but still would prefer if i could build a pipeline and more function inside it for each sources.  

Hi Team,I am currently working on one POC. I have created a Rest Collector, In the discovery section I have configured Crowdstrike API 1 which returns the list of resource ids. Post that, I am using a format discover results section to read all the resource ids one after the other in JS. These ids are dynamically passed to the query parameter of the next API 2 in the collect section. From API 2 response, I need to fetch an attribute related to device id and pass this attribute in the query parameter of the final API 3 whose response will be sent to the Splunk HEC destination.  I am currently not understanding how can I call this third API because Rest Collector doesn’t have  multiple collect sections and when I moved my data to pipeline to implement a code function to call the API 3, looks like its a limitation, I was not able to call external API from code function and I could not see any other functions in cribl that can support this. Is it possible to chai

Hi everyone,Does any of you ever tried to use the Logging level  known as silly? I’ve tried to use it for troubleshooting an issues on my env, but after less than 10 minutes, my three worker nodes were experiencing memory issues. One of my nodes went completely down, the other two remained with less than 1 GB of RAM (starting from 9 GB of free space in the beginning). I just want to know your experience/opinion on this, is it possible that my memory was not enough?