The journal
Teardowns, playbooks, and the economics of telemetry.
The journal is where we publish the analysis we run for ourselves: how platforms store and charge for telemetry, what migrations actually cost, and what ownership changes.
01Every piece
Newest first, every piece in full
18 pieces, each with original charts. Filter by what it covers or the seat you sit in.
18 pieces
Read your SIEM contract like an insurance policy
Read a SIEM contract like an insurance policy. The costliest clause is the one nobody can use, cancellation. A pipeline in front of the SIEM makes it usable again and lowers the premium too.
siem-cost, renewal, vendor-lock-in
You ingest for 90%, you detect 21%: the SIEM detection gap is a data problem
Across five years of production SIEMs, CardinalOps found organizations already ingest enough data to detect 90% of MITRE ATT&CK techniques, yet working rules cover only 21%, and 13% of rules are broken. More data will not close that gap. Detection-ready data, parsed and checked in a pipeline in front of the SIEM and routed by the detections it feeds, will.
detection-engineering, siem, mitre-attack
Your AI SOC agent pays for every log line too
An AI agent reads your logs the way your SIEM bills them, by volume. Microsoft's own sample Windows logon event is 710 tokens as raw XML and 152 once it is cleaned to the fields triage uses and enriched with the context an analyst would look up anyway. Clean once, in a pipeline in front of everything, and the SIEM, the lake and the agent all stop paying for noise.
agentic-systems, ai-cost, log-reduction
The parsing tax: why AI agents need telemetry in one schema
An AI agent handed raw vendor logs spends its context working out what the fields mean before it can reason about anything. A lake normalized to open schemas, OCSF for security events and OpenTelemetry semantic conventions for everything else, makes the same agent reach better verdicts and spend fewer tokens on each investigation.
agentic-systems, normalization, ocsf
Cribl pipelines as code: the Terraform path to reviewed changes and a recovery you can run
Most platform engineering teams went GitOps for everything in the 2020s. Observability tends to be the last UI-driven holdout, with pipeline configuration, parsers, detection rules, and routing logic still living inside vendor consoles with no diff history, no test suite, and no automated rollback. The Cribl Terraform provider plus Cribl's Git-backed worker groups close that gap. Here is how Cribl pipelines move from the UI to Git in production, why the Terraform provider is the load-bearing piece, how AI coding assistants become useful for pipeline maintenance once configuration is declarative, what disaster recovery looks like as a terraform apply instead of a manual rebuild, and the test layers that let detection engineering catch pipeline regressions before they reach production.
cribl, cribl-terraform-provider, pipeline-as-code
Why companies buy observability pipelines without a cost problem
More 2026 Cribl deployments now start without acute cost pressure. Companies are adopting the pipeline as insurance against the next SIEM migration, destination swap, or compliance ask. Here is what the new buying motive looks like, why teams like Yale New Haven Health moved 30,000 endpoints to Sentinel in two weeks because of it, and why pipeline insurance is reshaping how observability stacks get built in 2026.
cribl, pipeline-insurance, observability
Anatomy of a two-week SIEM migration: why the license overlap math has changed
Yale New Haven Health moved 30,000 endpoints onto Microsoft Sentinel in two weeks. Most teams still plan a SIEM migration as a 9-month, $350K project with a 30 percent failure rate. The cost story underneath is what most CFOs miss: the dual-license window where two SIEMs are paid for at once, which has historically run 3 to 9 months and consumed roughly half to three quarters of one year of the old SIEM's run-rate. Here is the license overlap math that has quietly changed under a pipeline-led architecture, why the conventional dual-license window collapses to days, and what to negotiate with the old and new vendors before the contract is signed.
siem-migration, cribl, license-overlap
Cyber insurance and the SIEM: what carriers ask for, and why many teams cannot produce it
Cyber insurance applications run 20+ pages and specifically require SIEM logs, MFA evidence, and centralized logging as conditions of coverage. Missing MFA is the #1 reason claims are denied. Here is what carriers really ask for, why most MSPs cannot produce the evidence across 76 tools, and the pipeline architecture that answers a 48-hour audit without scrambling.
cyber-insurance, siem, compliance
Cribl reduction is not data loss. It is a replay strategy your SIEM cannot offer
Cutting what reaches your SIEM does not mean dropping logs. It means reducing what hits the expensive tier while full-fidelity data streams to cold storage at a storage price. Here is how replay-from-archive works, why it is architecturally different from SIEM archive tiers, and what it looks like during a real incident.
cribl, reduction, replay
Alert fatigue: why most of your alerts are false positives, and what to do about it
The average SOC processes 4,484 alerts a day and up to 90 percent of them are false positives. Industry-wide that costs $3.3B a year in wasted triage. Here is why in-SIEM tuning never closes the gap and what a pipeline-layer fix actually changes.
alert-fatigue, false-positives, soc
Firewall allow logs: why you pay Splunk to index data nobody searches
Firewall allow logs are one of the largest sources of Splunk ingest in most environments. Detection rules do not fire on them. Analysts do not query them. Here is the routing architecture that sends them to S3 for a fraction of the cost while keeping your compliance archive intact.
splunk, firewall-logs, cost-reduction
SIEM migration without the nine-month overrun: a Cribl playbook
SIEM migrations take a 9-month median, cost $350K, and fail 30 percent of the time. Here is how a Cribl routing layer cuts that to three to six months with zero compliance gap, zero double-licensing, and per-source validation.
siem-migration, cribl, parallel-routing
Datadog bills: why you may be paying twice, and how to stop
Datadog charges you to ingest logs and again to index them. Custom metrics quietly become 30 to 52 percent of the bill. Twenty-five plus SKUs make cost modeling impossible. Here is where the money actually goes and the routing architecture that stops it.
datadog, cost-optimization, observability
The MSP margin trap: why your SIEM bill grows faster than your revenue
MSP profit margins should be 30 to 35 percent. Most operate at 8 to 12 percent. The structural problem is usage-based SIEM pricing against flat-rate client billing. Here is how the math works and what pipeline architecture changes.
msp, siem, cost-optimization
Route before you index: how a pipeline cuts what Splunk indexes
Firewall allow logs are among the largest and least searched sources in most Splunk estates. Here is the pipeline architecture that sends the events your detections use to Splunk and a full copy of everything to S3 at storage prices.
splunk, cribl, cost-reduction
Five signs your observability stack needs a pipeline layer
Your SIEM bill keeps climbing. Onboarding new data sources takes weeks. Your team spends more time on parsing config than security analysis. These are signals that a routing layer belongs in your architecture.
observability, siem, pipeline-architecture
QRadar is sunsetting: your migration playbook
IBM sold QRadar SaaS to Palo Alto. On-premises is maintenance-only. Forrester advises against new purchases. Here is how to plan a gradual migration using parallel routing through a Cribl pipeline.
qradar, siem-migration, ibm
Why Sentinel commitment tiers do not work for MSPs
Sentinel prices commitment tiers per workspace with no ability to pool across tenants. For MSPs managing 30 clients, that means 30 separate cost buckets with no optimization. Here is what a pipeline layer changes.
sentinel, microsoft, msp
See your architecture drawn, with the costs, before you spend anything.
Our lead architects draw your SIEM feed from your diagrams: where the cost sits, what step one would change, and where it would not pay. If it pays, the next step is a two-week proof on your noisiest source.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing