Community Discussions

Hi everyone,Does any of you ever tried to use the Logging level  known as silly? I’ve tried to use it for troubleshooting an issues on my env, but after less than 10 minutes, my three worker nodes were experiencing memory issues. One of my nodes went completely down, the other two remained with less than 1 GB of RAM (starting from 9 GB of free space in the beginning). I just want to know your experience/opinion on this, is it possible that my memory was not enough? 

Apply!Job Title: Security Engineering ManagerLocation: Port Sunlight, UKWork Level: WL2B JOB PURPOSEThe Security Engineering Manager is responsible for deploying and managing the cyber security technology stack to ensure our key cyber risks are being appropriately managed. This requires collaboration between our Business Owners (i.e. who operate these capabilities) and our suppliers – all with the common goal of continuous improvement. This position will report to the Head of Security Engineering.RESPONSIBILITIES• Managing our Cyber Security capabilities (in partnership with the relevant Business Owner) including SIEM, SOAR, CSPM, N

AI Engineer at Elevance HealthJob Description:AI Engineer Location: This role requires associates to be in-office 1 - 2 days per week, fostering collaboration and connectivity, while providing flexibility to support productivity and work-life balance. This approach combines structured office engagement with the autonomy of virtual work, promoting a dynamic and adaptable workplace. Alternate locations may be considered if candidates reside within a commuting distance from an office. Please note that per our policy on hybrid/virtual work, candidates not within a reasonable commuting distance from the posting location(s) will not be considered for employment, unless an accommodation is granted as required by law.

Apply! About the jobWe help the world run betterAt SAP, we keep it simple: you bring your best to us, and we'll bring out the best in you. We're builders touching over 20 industries and 80% of global commerce, and we need your unique talents to help shape what's next. The work is challenging – but it matters. You'll find a place where you can be yourself, prioritize your wellbeing, and truly belong. What's in it for you? Constant learning, skill growth, great benefits, and a team that wants you to grow and succeed.Job DescriptionAt SAP, we are seeking a highly skilled Security Data Platform Engineer Expert to join our dynamic Data Platform Engin

Clone the repository here:https://github.com/criblio/terraform-provider-criblioAnyone using it yet?  Let us know how it’s going. 

Hello,I’m using Cribl Cloud to pull JSON events from an Azure Event Hub and forward them to Splunk via HEC. Each incoming event contains a nested array field called records, for example:{ "records": [ { "FileName": "xx", "FileType": "xx", "NetworkMessageId": "xx", "RecipientEmailAddress": "xx", "RecipientObjectId": "xx", "ReportId": "xx", "SHA256": "xx", "SenderDisplayName": "xx", "SenderObjectId": "x", "SenderFromAddress": "x", "FileSize": x, "Timestamp": "xx", "TimeGenerated": "xx", "_ItemId": "xx", "TenantId": "xx", "_TimeReceived": "xx", "_Internal_WorkspaceResourceId": "xx", "Type": "xx" }, { "FileName": "xx", "FileType": "xx", "NetworkMessageId": "xx",

HI all just wanted to confirm if CIDR ranges are supported in no proxy setting where i want to mention CIDR range of leader node in worker node settings instead of directly providing leader node IP.Is there any additional settings needed to make this work? 

How can I get a list of users that includes their sso/mfa status?

How can I use a Cribl endpoint to retrieve a list of API Credentials created? I’m looking for a programmatic way to do this, not looking at a list via the interface. /system/secrets and /system/keys don’t seem to be the right endpoints. 

In both the API Reference (with authenticated session) and via Python, I started running into an issue with submitting queries to the POST /search/jobs API to submit a remote query to Cribl Search.Despite the fact that it's a POST endpoint, and I'm using the headers generated by the API Reference, I receive the following error<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>Error</title></head><body><pre>Cannot POST /api/v1/search/jobs</pre></body></html>In the API Reference this is the payload I am POST'ing with application/json as the accept and Content-Type - the Auth comes from my session automatically{ "query": "cribl dataset=\"cribl_internal_logs\" | limit 10 "}In Python, I attempted to recreate it as well, I can confirm that the Client ID and Client Secret are valid and I receive

Hi,I'm working on code that uses an API key to access my data in Cribl. I started by creating API credentials (client_id and client_secret) and built a simple script to obtain an access token, which I plan to use for querying logs.Here’s the code I wrote:import requestsclient_id = 'XXX'client_secret = 'XXX'auth_url = 'https://XXX.cribl.cloud/api/v1/auth/token'payload = {'grant_type': 'client_credentials','client_id': client_id,'client_secret': client_secret,'audience': 'https://api.cribl.cloud'}headers = {'Content-Type': 'application/json'}response = requests.post(auth_url, data=payload, headers=headers)When I run this, I receive a 200 response, but the content is not in JSON format. Instead, the content is:you need to enable JavaScript to run this app.It seems to be returning the w

As the title says, I’m looking to create and update a lookup table based on incoming events, somewhat similar to the outputlookup function in splunk. Is there any way to update or create a table based on fields from events passing through a pipeline?

Are you ready to publish a Pack? Check out the recently updated publication standards to make sure everything goes smooth and easy. 

Looking for a configuration example for sending webhook notifications to Teams channel.

Hi All,We are managing Crowdstrike NGSIEM  in our network and all the data sources are routed to Cribil and from Cribil , we are forwarding the logs to NGSIEM. Data source → Cribil →  NGSIEM I understand , we require parsers in NGSIEM to read the relevent logs received from the  datasources but I wish to know ,is there any parser concept present in cribil to onboard the logs from the different datasources.    

CVS has an exciting opportunity to lead a team transforming Observability at massive scale!https://jobs.cvshealth.com/us/en/job/R0634510/Lead-Director-Observability-Engineering

This is an example of how we can reference a value provided by Discover Type HTTP Request in the REST API Collector which will correctly save a bearer token value which will expire (default time 5 minutes) using a named Token attribute: token, Authorization header `Bearer $(token)` and Authentication expression `Bearer $(token)` The initial authorization request:curl -X POST 'http://localhost:9000/api/v1/auth/login' -H "Content-Type: application/json" -d '{ "username": "admin", "password": "<password value here>" }' Run a Discover request to generate a bearer token: The above request will return a value something like: {"token":"abcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdef

hello,i need options on how to enrich data coming from zabbix as a source on cribl stream before it reaches the destination by API or Http requestthe data is on database i need to call the database by API to fetch the data using fields in the data payload from zabbix and enrich the data received from zabbix then forward it to destinationnote : i want to get the data on fly and the API call will use attributed from the data payload this is the URL that i want to use and will take the massagegroup and the application value from the data payload to call the needed data to be enrichedhttp://IP:25050/3i_service.php?MESSAGEGROUP=X&APPLIKATION=Yi tried by code on the pipeline to do httprequest but it didn't work

The team at  CINQ has open-sourced their new utility tool:More details

Position Overview: As a Security Data Mesh Architect specializing in solving complex data challenges across multiple hyper-scaler clouds, you will be responsible for designing, implementing, and optimizing a microservices approach to security data generation, collecting, transformation, storage and analytics within cloud platforms like Google Cloud Platform (GCP), Amazon Web Services (AWS), and Microsoft Azure. You will play a key role in ensuring the scalability, reliability, and security of our growing data challenges including observability, providing expert guidance, and developing innovative solutions to enhance the value of large data sets.Apply Here

Reporting to the Sr Director, this role sets the vision and strategy for the data platform, ensuring alignment with business goals and scalability. Responsibilities include overseeing data architecture, defining governance frameworks, and driving the development of scalable processes. Additionally, they will build and mentor a high-performing data team, raise data literacy, and ensure program execution aligns with enterprise architecture and security policies. This team is pivotal in securing Sony’s information assets, building trust with customers, and protecting privacy.Apply Here

Had a situation where the automatic upgrade was not working, so had to manually upgrade.From the logs it was trying to download ARM version not X64 version.Fortunately managed to figure out the correct weblink by changing the file name slightly: https://cdn.cribl.io/dl/4.10.1/cribl-4.10.1-45136dbb-linux-x64.tgz.Are these links listed anywhere on the cribl website, or how would we manually upgrade?

Hello,I noticed a strange thing maybey anyone can explain.I have 3 syslog sources: syslog:514: ,syslog:51402: and syslog:51403:Three routes for these sources, each with a different pipeline attached. The order off the routes are 514 then 51402 and at last 51403.The filter in de routes are __inputId.startsWith('syslog:514:') &&  __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51402:') && __srcIpPort.includes('10.10.1.112')__inputId.startsWith('syslog:51403:')&&  __srcIpPort.includes('10.10.1.112')(same host with different syslog outputs)In this order the 514 port gets a load off events, the 51402 lesser and teh 51403 nothing. That surpised me because when a check the source side i can capture 51403 events from this sourceip.For test i moved the 514 route after the 51403 route. Just a feeling. but what??.. the 51403 gets suddenly l the events it was missing. And here it

HiI setup a worker node on premise by running the script captured from cribl leader cloud. I enabled UI access for worker node. I can open the link in browser but what will be the credentials for it ?Thanks

I am new with Cribl.Cribl Edge (standalone, installed on Windows 10 laptop for test/evaluation): Windows Metrics do not return actionable information when forwarding to a standalone Splunk Enterprise instance. What am I doing wrong or what I am missing here?Windows Eventlog cribl-source is correctly received in json. But adding the Windows Metrics cribl-source to the same (working) Splunk Destination (default forwarding to port 9997) it shows:All relevant metric_names seems to be received correctly, but no Values to find. Besides, do not understand the metric_type "g". I would expect a value-field in bytesI have