General

This discussion has been moved.

This discussion has been moved.

This discussion has been moved.

This discussion has been moved.

This discussion has been moved.

This discussion has been moved.

This discussion has been moved.

This discussion has been moved.

Happy Release Day to everyone! We have launched Cribl v.4.3.1. While a lot was done to improve and fix a few things with this release being a maintenance release, we also have a lot great new features. Grab the latest download from https://cribl.io/download/!StreamThe Azure Blob Storage Collector and Google Cloud Storage Collector can now ingest and replay data in Parquet format. (This matches the S3 and Filesystem Collector' previously announced Parquet support.)The SNMP Source now supports SNMPv3 for user authentication and data privacy.The SNMP Trap Source now supports multiple users via SNMPv3, allowing you to receive traps from multiple devices configured with different users.

Does anyone know if the MinIO destination in Cribl Stream supports virtual hosting style addressing? In my experience it only seems to support path-style addressing which was deprecated by AWS in 2020.

Get ready to feast your eyes on our latest release! v4.4 brings several new capabilities and usability improvements to your Cribl deployment. Here are some of the features I am excited for. Make sure to check out the release notes for all the new features and corrections. Stream: https://docs.cribl.io/stream/release-notes/release-v44/ New Azure Data Explorer (ADX) native Destination enables sending security and observability data directly to ADX. This integration enables sending data to Azure Data Explorer customer tables as well as Cribl's supported native tables.System Metrics Source now supports configuring 

In an era where industry standards are as dynamic as the data they govern, Cribl’s core value of putting ‘Customers First, Always’ drives us to stay ahead of the curve. It’s with immense pride and excitement that we announce our strategic partnership with Elastic. This alliance isn’t just a meeting of minds; it’s a bold stride towards a future where flexibility in data management isn’t just a luxury – it’s the standard.Together, we combine our strengths in data processing with Elastic’s AI-driven search analytics to provide our customers with enhanced real-time insights and automated threat detection. This partnership is set to turn organizations’ data deluge into a strategic advantage, where efficient management meets precise compliance and actionable insights.You can read more about this exciting partnership at

End of Support for CentOS 6We will be deprecating support for CentOS 6 with our Cribl Stream and Cribl Edge 4.4.4 release. CentOS 6 reached its End-of-Life (EOL) status in 2020. Continuing to support it would impact our ability to maintain the high security standards we set for our products and customers. Removing support for CentOS 6 in a future version allows us to focus on more stable and secure environments.Action Required for Cribl Stream and Cribl Leader Users on CentOS 6If you are currently running Cribl Stream and the Cribl Leader on CentOS 6, we strongly recommend that you upgrade your operating system to at least CentOS 7 or later before updating to version 4.4.4. This step will ensure future functionality and security.Guidance for Cribl Edge Node Users on CentOS 6For those running Cribl Edge Nodes on CentOS 6, we strongly recommend upgrading your OS to CentOS 7 or later before updating you

Version 4.4.4 adds new capabilities and usability improvements to Cribl Stream, Cribl Edge, Cribl Search, and Cribl.Cloud:• Load balancing in the Webhook Destination. You can enable load balancing and specify multiple webhook URLs and their load weights, which sets relative traffic-handling capabilities for each connection. You can also choose whether to exclude all IPs of the current host from the list of resolved hostnames.• Exponential backoffs for HTTP request timeout errors in HTTP-based Destinations. You can configure the values for initial retry delay, retry delay multiplier, and maximum retry delay. This helps build in a time buffer before Stream retries an HTTP request.• Custom session timeout in Cribl.Cloud. In Cribl.Cloud Global Settings, you can now configure a Session idle time limit for the GUI. This helps keep pages up longer.• Cribl Search results are now automatically sorted in de

We've unleashed the Cribl Search sandbox in Cribl.Cloud. Get ready to dive into a world of Search wizardry where you'll master the magic of search syntax, data aggregation, data summarization, and even conjure up some dashboards from your saved searches. The best part? The sandbox is completed within your Cribl.Cloud organization, allowing you to return to it at any time.Click here and let the data adventures begin!

Hi, I've been struggling with getting pagination to work correctly using the RestAPI Collector as a source. I'm trying to programmatically have Cribl grab software vulnerabilities that are identified in GitHub CodeQL using this API call:https://api.github.com/repos/myorg/myrepo/code-scanning/alertshttps://docs.github.com/en/rest/code-scanning/code-scanning?apiVersion=2022-11-28#get-a-code-scanning-analysis-for-a-repositoryI am able to successfully get the response, but I cannot figure out how to get pagination to work. The closest I've been able to get is adding the "per_page" parameter to my API call and hoping my containers have less than 100 vulnerabilities. I've tried adding "Link" as the response header attribute with no luck. When I do that, it seems to create an endless loop when I do a full run. Any guidance would be much appreciated.https://docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api

Is there a way to implement a password change on a Cribl Cloud local account WITHOUT using the "forgot password" link on the login page? Our access management process needs to have something like an API call or a simple password reset page available in order to implement our password management process.

Hi ,How do I make sure that only specific IP addresses or IP ranges can access my Cribl organization’s domain URL ?Thank you in advance

Hi there,Does anyone has a working configuration to pull box.com API events that could share?I have been trying the following and somehow it is not working for me, not sure if I am not using the proper App or missing something else.https://github.com/criblio/collector-templates/tree/main/collectors/rest/box

I have a REST collector that is using Discover to collect the ID of the log I'm importing. Then an event breaker using the File Header break type. The issue is that I don't know what version of the event the Auto Timestamp extractor tries to process. The event from discovery where the format is JSON or the raw event during breaking. When I run the preview from the REST collector, I have have fields I can work with for the auto extraction unless auto extraction only works on the raw event which is CSV.