Community Discussions

Every time we update openshift in azure, my cribl config is lost. since we have the free version, we cannot use git repository. would using persistent storage helps keep the config because the update process drains the node from the cluster and restart them on another node. I suspect this is why the config is not kept.

Can i install Cribl Edge on my worker nodes without any production impact. `I want to use Cribl  Edge to monitor my Cribl Workers and certain files

cisco_asa_cleanup pack is not working for me, now sure how to make it work , need help in utilizing it, sample logsOct 1 03:23:58 asa_server_ip %ASA-6-302014: Teardown TCP connection 39876417 for VTI-Murex-abc:xx.xx.xx.xx/443 to inside:xx.xx.xx.xx/44714 duration 0:00:00 bytes 9514 TCP FINs from inside 0 0Oct 2 06:51:58 asa_server_ip %ASA-6-302013: Built inbound TCP connection 39876427 for VTI-Murex-abc:xx.xx.xx.xx/34664 (x.x.x.x/34664) to inside:xx.xx.xx.xx/443 (x.x.x.x/443) -1 -1Oct 3 04:54:58 xx.xx.xx.xx %ASA-6-302013: Built outbound TCP connection 39876426 for VTI-Murex-abc:x.x.x.x/443 (xx.xx.xx.xx443) to inside:x.x.x.x./14326 (xx.xxx.xx.xx/14326) 1 5Oct 5 01:54:58 xx.xx.xx.xx %ASA-6-302020: Built inbound ICMP connection for faddr xx.xx.xx.xx/54615 gaddr x.x.x.x/0 laddr x.xx.x.xx/0 type 8 code 0 Internal-Data0/-1:RX[-1]Oct 15 07:54:58 xx.xx.xx.xx%ASA-6-106015: Deny TCP (no connection) from x.x.x.x/38492 to xxx.xx.xx.x/6425 flags ACK  on interface VTI-Murex-abc  

Hi all i am trying to upload few packs into stream leader using files but getting below sample error Error while installing Pack file cribl-cisco-asa-cleanup-1.1.15 (1).crbl in Group: Dev-OP: failed to install: ENOENT: no such file or directory, open '/opt/cribl/state/packs/cribl-cisco-asa-cleanup.LtY1yaM.tmp/data/lookups/asa_drops.csv'. what does this error suggest we have already uploaded few which got uploaded. 

​Hi Team,I’m working on an SNMP trap pipeline where:Input event has fields like trap_name and trap_varbind_apSysMgmtTaskSuspend.I have a Lookup table that maps:trap_name → varbindname → Output_attribute_value.After Lookup, I want to create a new field dynamically:Field name = value of Output_attribute_value (e.g., id)Field value = value from the field referenced by varbindname (e.g., trap_varbind_apSysMgmtTaskSuspend).I tried using Eval with:JavaScript[Output_attribute_value] = get(__payload, varbindname)Show more lines…but got Unallowed assignment operator error.Then I tried a Code function: JavaScriptconst targetField = event.Output_attribute_value;const sourceField = event.varbindname; if (targetField && sourceField && event[sourceField]) {event[targetField] = event[sourceField];}Show more linesBut the new field (id) still doesn’t appear in the final JSON.Questions:Is Code function the right approach for dynamic field names?How can I verify Lookup values before Code

Is there a way of directly integrating netskope with cribl using rest api’s without using s3 Buckets for transactional logs

Hi all, I just completed the Level 3 Prerequisite exam but I have a question.One of the questions was as follows:What would be the result of the Mask function with the following settings Match Regex =`(user_id=) (d+)" Replace Expression = C. Mask. random( ${g2}') on the event host=server. local user_id=12345?A)host=server. local aeQI9B) host=server. local user_id=fe8780bd8237b0388df7175034db75d6C) host=server. local user_id=aeQI9D) The event would remain unchanged because the Match Regex is invalid.I chose option D. But apparently this was the wrong answer. But I think it shouldn't be… Here is why.The event host=server.local user_id=12345….(user_id=) (d+) matches “user_ID=”(d+) is incorrect, d is just a literal d and not a digit in this case, it should have been \d+. There is also a space in the regex, but the event itself does not have a space. “user_id=12345”This is why the event would remain unchanged because the match regex is invalid. If I am wrong, please explain to me where I am

We would like to stream data into RDBMS, but we don’t see the option rdbms destination. How can this be achieved?

Previews of our new Terraform provider and SDKs are ready for you to explore!Check out the details on the Cribl as Code page.Kick the tires and tell us what you think!

HI all  I am trying to create a pipeline where all syslog data will land and i want to filter the events from device i want based on a string in _raw filed like firewall or any other unique string.i have tried _raw.includes(‘Firewall’) or /Firewall/ though when i  check in advanced mode in filter tab it matches the correct event but when i am checking it on a sample log i have built for testing it passes all the events regardless of filter.I know this can be done in routes itself but still would prefer if i could build a pipeline and more function inside it for each sources.  

Hi Team,I am currently working on one POC. I have created a Rest Collector, In the discovery section I have configured Crowdstrike API 1 which returns the list of resource ids. Post that, I am using a format discover results section to read all the resource ids one after the other in JS. These ids are dynamically passed to the query parameter of the next API 2 in the collect section. From API 2 response, I need to fetch an attribute related to device id and pass this attribute in the query parameter of the final API 3 whose response will be sent to the Splunk HEC destination.  I am currently not understanding how can I call this third API because Rest Collector doesn’t have  multiple collect sections and when I moved my data to pipeline to implement a code function to call the API 3, looks like its a limitation, I was not able to call external API from code function and I could not see any other functions in cribl that can support this. Is it possible to chain multiple Rest collectors,

Hi everyone,Does any of you ever tried to use the Logging level  known as silly? I’ve tried to use it for troubleshooting an issues on my env, but after less than 10 minutes, my three worker nodes were experiencing memory issues. One of my nodes went completely down, the other two remained with less than 1 GB of RAM (starting from 9 GB of free space in the beginning). I just want to know your experience/opinion on this, is it possible that my memory was not enough? 

Apply!Job Title: Security Engineering ManagerLocation: Port Sunlight, UKWork Level: WL2B JOB PURPOSEThe Security Engineering Manager is responsible for deploying and managing the cyber security technology stack to ensure our key cyber risks are being appropriately managed. This requires collaboration between our Business Owners (i.e. who operate these capabilities) and our suppliers – all with the common goal of continuous improvement. This position will report to the Head of Security Engineering.RESPONSIBILITIES• Managing our Cyber Security capabilities (in partnership with the relevant Business Owner) including SIEM, SOAR, CSPM, NDR, EDR / XDR, IDP, DAM, NAC, WAF, TVM, Email Security, Threat Intelligence Platforms, Security Validation Platforms, Penetration testing platforms, etc.• Defining (in partnership with the relevant Business Owner) the requirements for our capability and identifying any gaps that require addressing.• Partnering our Security Architecture colleagues in defining

AI Engineer at Elevance HealthJob Description:AI Engineer Location: This role requires associates to be in-office 1 - 2 days per week, fostering collaboration and connectivity, while providing flexibility to support productivity and work-life balance. This approach combines structured office engagement with the autonomy of virtual work, promoting a dynamic and adaptable workplace. Alternate locations may be considered if candidates reside within a commuting distance from an office. Please note that per our policy on hybrid/virtual work, candidates not within a reasonable commuting distance from the posting location(s) will not be considered for employment, unless an accommodation is granted as required by law. PLEASE NOTE: This position is not eligible for current or future visa sponsorship. The AI Engineer is responsible for analyzing and modeling organizational data for the Artificial Intelligence (AI) function to draw business insights, which can be used to make business decisions. 

Apply! About the jobWe help the world run betterAt SAP, we keep it simple: you bring your best to us, and we'll bring out the best in you. We're builders touching over 20 industries and 80% of global commerce, and we need your unique talents to help shape what's next. The work is challenging – but it matters. You'll find a place where you can be yourself, prioritize your wellbeing, and truly belong. What's in it for you? Constant learning, skill growth, great benefits, and a team that wants you to grow and succeed.Job DescriptionAt SAP, we are seeking a highly skilled Security Data Platform Engineer Expert to join our dynamic Data Platform Engineering Design Team. You will be instrumental in the development, maintenance, and optimization of our Data Platform tools within the SAP global logging and monitoring ecosystem. This role involves building and maintaining the infrastructure for our global Detection Platform, collaborating with key stakeholders, and serving as a mentor to Operati

Clone the repository here:https://github.com/criblio/terraform-provider-criblioAnyone using it yet?  Let us know how it’s going. 

Hello,I’m using Cribl Cloud to pull JSON events from an Azure Event Hub and forward them to Splunk via HEC. Each incoming event contains a nested array field called records, for example:{ "records": [ { "FileName": "xx", "FileType": "xx", "NetworkMessageId": "xx", "RecipientEmailAddress": "xx", "RecipientObjectId": "xx", "ReportId": "xx", "SHA256": "xx", "SenderDisplayName": "xx", "SenderObjectId": "x", "SenderFromAddress": "x", "FileSize": x, "Timestamp": "xx", "TimeGenerated": "xx", "_ItemId": "xx", "TenantId": "xx", "_TimeReceived": "xx", "_Internal_WorkspaceResourceId": "xx", "Type": "xx" }, { "FileName": "xx", "FileType": "xx", "NetworkMessageId": "xx", "RecipientEmailAddress": "xx", "RecipientObjectId": "xx", "ReportId": "xx", "SHA256": "xx", "SenderDisplayName": "xx", "SenderObjectId": "x", "SenderFromAddress": "x", "Fil

HI all just wanted to confirm if CIDR ranges are supported in no proxy setting where i want to mention CIDR range of leader node in worker node settings instead of directly providing leader node IP.Is there any additional settings needed to make this work? 

How can I get a list of users that includes their sso/mfa status?

How can I use a Cribl endpoint to retrieve a list of API Credentials created? I’m looking for a programmatic way to do this, not looking at a list via the interface. /system/secrets and /system/keys don’t seem to be the right endpoints. 

In both the API Reference (with authenticated session) and via Python, I started running into an issue with submitting queries to the POST /search/jobs API to submit a remote query to Cribl Search.Despite the fact that it's a POST endpoint, and I'm using the headers generated by the API Reference, I receive the following error<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot POST /api/v1/search/jobs</pre></body></html>In the API Reference this is the payload I am POST'ing with application/json as the accept and Content-Type - the Auth comes from my session automatically{ "query": "cribl dataset=\"cribl_internal_logs\" | limit 10 "}In Python, I attempted to recreate it as well, I can confirm that the Client ID and Client Secret are valid and I receive a valid token. Here is the relevant portion of that script.def generateBearerToken() -> str: url = "https://

Hi,I'm working on code that uses an API key to access my data in Cribl. I started by creating API credentials (client_id and client_secret) and built a simple script to obtain an access token, which I plan to use for querying logs.Here’s the code I wrote:import requestsclient_id = 'XXX'client_secret = 'XXX'auth_url = 'https://XXX.cribl.cloud/api/v1/auth/token'payload = {'grant_type': 'client_credentials','client_id': client_id,'client_secret': client_secret,'audience': 'https://api.cribl.cloud'}headers = {'Content-Type': 'application/json'}response = requests.post(auth_url, data=payload, headers=headers)When I run this, I receive a 200 response, but the content is not in JSON format. Instead, the content is:you need to enable JavaScript to run this app.It seems to be returning the web application HTML rather than a JSON response with an access token. My goal is to use this token in a query to fetch logs.Could you please help me understand why the token request is returning HTML instead

As the title says, I’m looking to create and update a lookup table based on incoming events, somewhat similar to the outputlookup function in splunk. Is there any way to update or create a table based on fields from events passing through a pipeline?

Are you ready to publish a Pack? Check out the recently updated publication standards to make sure everything goes smooth and easy. 

Looking for a configuration example for sending webhook notifications to Teams channel.