What you runRunning Cribl?
You run Cribl. We run it at an expert level.
Cribl does a good job out of the gate: collect once, parse, drop the obvious, route. We take it further: aggressive aggregation and suppression, security context added to every event in flight, data prepared for an AI SOC, and the whole pipeline as code, with version control, drift detection and CI/CD.
Free. No system access. No obligation. You keep the drawing.
Step oneCribl in front of your SIEM, designed and built by Logmetry. Your SIEM stays. A full raw copy stays in your own account.
At least 20% less into your SIEM, every alert kept, proved on your data.
Cribl Stream Pipeline
$0.26 per GB ingested
To process 1 GB with workers in your own cloud, at list price.
Cribl lists its own cloud workers at 0.32 credits per GB, plus infrastructure. Free up to 1 TB a day. At $0.26, one GB every day for a month is $7.80, against about $150 at Splunk Enterprise Security list.
Cribl Stream pricing page, checked 2026-10-05
01Where Cribl stops short
Cribl out of the gate, and how far it can go.
On this page Cribl is the pipeline, so the question is not whether to put one in front of your SIEM. It is how far it goes: reduction that knows what each source means, data ready for AI agents, a raw copy for audit, and every change as reviewed code.
“We run Cribl, and mostly it filters and forwards.”
Cribl at an expert level. Aggregation, suppression and context, source by source.
- Why it happens
Out of the gate Cribl does a good job: parse, drop the obvious, route. The larger wins sit deeper, in aggregating repetitive events, suppressing floods and duplicates, and enriching each event with the context a detection needs. That takes knowing what every source means, field by field.
- What changes
We work every source against your detections. Firewall and flow logs are aggregated to what detection reads. Repeated events are suppressed within a window, with the count kept. Windows security events are trimmed to the fields triage uses and enriched in flight with the host’s role, the account’s privilege and the attack technique the event can indicate.
- How sure you can be
Nothing is lost. Aggregated and suppressed events keep their counts, the full raw copy lands in an archive you own and replays on demand, and every rule is readable code, measured before and after on your own sources.
- How soon
With the first source. We start with your most expensive one.
- What it takes from you
Access to your Cribl leader or a sandbox, and one call with the person who owns your SIEM detections.
What changes, source by source
- AggregationFirewall, flow and DNS volume rolled up to what detection reads, with the raw copy kept.
- SuppressionFloods and duplicates collapsed within a window, with the count carried in the event.
- Context enrichmentHost role, account privilege, asset owner and the attack technique, added in flight.
- Every destination fed what it is forThe SIEM gets what detection reads, the Lake the clean copy, the archive the raw one.
“Our SOC is adding AI agents, and they read the same raw logs our SIEM does.”
Data an AI SOC agent can reason on. Cleaned once, in the pipeline you already run.
- Why it happens
An agent reads logs by the token. Raw Windows XML, vendor field names and events with no context make it spend its budget parsing instead of investigating, and it gets more answers wrong.
- What changes
Cribl normalizes each source to one schema, trims every event to the fields triage uses, and adds what an analyst would otherwise look up: who owns the host, how privileged the account is, whether it happened out of hours, which technique it maps to. The clean copy lands in a Lake your agent reads.
- How sure you can be
One public example, measured: Microsoft’s sample Windows logon event is 710 tokens as raw XML and 152 once cleaned and enriched. The method is in the journal.
- How soon
As soon as the first source lands clean, your agent has something worth reading.
- What it takes from you
Your triage runbooks, or we write them with you.
What your agent reads
- One schema across sourcesOCSF, so one question works on every source.
- Only the fields triage usesFewer tokens per investigation, and less noise in the answer.
- Context inside the eventThe lookups an analyst would make are already done.
- A clean Lake to searchDeduplicated and enriched, in your account, at storage prices.
“Our pipelines live in the Cribl UI, and only a couple of people understand them.”
Cribl as code. Version control, drift detection, CI/CD.
- Why it happens
Configuration edited by hand in a UI drifts from what anyone reviewed, cannot be tested before it ships, and leaves with the people who wrote it.
- What changes
Pipelines, routes and packs live in your Git repository. Every change is a pull request, tested and deployed to the leader by CI/CD, and drift between the repository and what actually runs is detected and reported. Your engineers and AI coding agents work on the same files in the code editor, so a new source or a fixed parser is a reviewed change in hours.
- How sure you can be
A person reviews every change before it deploys, and rolling back is reverting a commit.
- How soon
In the foundation project, before the first source moves.
- What it takes from you
A repository and a CI runner in your account. We hand the whole thing to your team.
Your pipeline, as code
- Version controlGitEvery pipeline, route and pack in your repository, with its history.
- Drift detectionWatchedWhat runs is compared with what was reviewed, and differences are reported.
- CI/CD deploysReviewedTested and deployed by your pipeline, never by hand in the UI.
- AI agents in your editorFasterA coding agent drafts the change, your team reviews and merges it.
- HandoverYoursLeaving us, or losing us, costs a handover, not a rebuild.
“We cut volume, and now audit and the investigators ask where the rest went.”
Reduce without losing anything. The raw copy for audit, the clean copy for the agent.
- Why it happens
Reduction that drops data trades a bill for a blind spot. A lake that receives everything raw becomes a dump nobody can search.
- What changes
Cribl writes the full raw copy to an archive in your account for audit and replay, the cleaned and deduplicated copy to the Lake for search and agents, and only what detection reads to the SIEM. Any hour replays into the SIEM when an investigation needs it.
- How sure you can be
Every byte is kept once, raw, under your keys. Every route is code you can read.
- How soon
With the first source.
- What it takes from you
A storage account you own, and your retention rules.
Where each copy goes
- Raw eventsToday: Into the SIEM, or droppedWith you in control: An archive in your account, replayable
- Clean eventsToday: Nowhere an agent can readWith you in control: The Lake, deduplicated and enriched
- Detection dataToday: Everything, billed per GBWith you in control: The SIEM, only what it reads
- An investigationToday: Limited to SIEM retentionWith you in control: Any hour replayed on demand
02Today, and after
Today, and with the Blueprint
An estate running Cribl owns the pipeline. The usual gaps are depth and discipline: reduction that stopped at filtering and forwarding, events that reach the SIEM and the agents raw, and pipelines living in a UI instead of a repository.
Scroll the drawing sideways to see all of it.
What Cribl does best
Cribl Stream is the strongest general-purpose control layer in the market: collect once, route to many destinations, parse, trim, and enrich in flight, at enterprise scale. If you already run it, you made the right call.
The gap we usually find is depth and discipline. Reduction stops at filtering and forwarding. Events reach the SIEM and the agents raw, without the security context that makes them useful: what a Windows event means, which host and account it touches, which attack technique it can indicate. And the pipelines live in a UI instead of a repository, edited by hand, with no review and no record of drift.
How it works, and where we sit
Cribl Stream is the control layer itself: worker nodes receive from every source, run each event through pipelines and routes, and send each destination only what it is for, with the whole configuration held by a leader and backed by git. It is not a SIEM, it holds no detections, and it is licensed by the GB it processes in credits. An estate that already runs it has the hard part in place, and the work is what stands on it: tuning per source, the Lake partitioned for retrieval, and the phases beyond.
03The five verbs
What we keep, and what changes
Keep it and govern what flows in, shrink its footprint, cut what it costs, extend it with an agent, and replace only where replacement is honest.
- Keep
Stream as your log control layer. It is the engine we reach for in exactly this seat, and your investment in it compounds from here, because every later phase stands on the routing it already does.
- Shrink
The sources nobody tuned yet. Reduction is worked source by source against your top talkers, measured before and after, so the number the SIEM bills is one you can show rather than estimate.
- Cut
The destinations keep receiving only what earns its place, and the config moves into your repository where changes are reviewed and testable.
- Extend
The Lake becomes partitioned and enriched rather than parked, and the agent phases stand on it: triage and root cause reading history Cribl landed.
- Replace
Nothing. This estate already owns the hard part. The work is making it produce everything it can.
The letters mark where each verb acts in the drawing with the Blueprint.
From a pipeline to a foundation
The difference between running Cribl and owning a foundation is code, partitioning, and the phases that stand on top.
Pipelines and configuration move to repository-backed management, so every change is reviewed, testable, and reproducible. The Lake gets the treatment that makes it an asset: enrichment in flight, partitioning that matches how investigations move, and a compliance archive that answers auditors with a query.
From there the Blueprint's later phases open up in order: agents that triage your alerts on the clean history Cribl has been landing, then the same agents fixing what they find as pull requests, then collecting once under a fleet you own and footprint reduction against the per-node monitors.
Per source
The per-source structure
The first source goes end to end against criteria agreed in writing before the rollout continues, so trust never has to run ahead of proof.
Cribl work is the one engagement we price per source, because the unit of work is genuinely the source. The foundation is one fixed-price project: Stream deployed or brought under management, the pipeline and its configuration as code, the repository and the API-driven deploy. Then the estate moves source by source, typically one to two weeks each, each with its reduction measured and its acceptance criteria agreed in writing before it starts.
The first source is the proof. It goes end to end, against written criteria, before the rollout continues, so you are never asked to trust the method further than it has already demonstrated. An estate that already runs Cribl is tuned the same way, per source, starting with your most expensive one.
04The free architecture review
We draw your Cribl estate, free.
Telemetry engineers look at your whole environment and show you exactly where the cost, the waste and the hurdles are, and what your architecture could look like. No strings attached.
What you get
- Your Cribl architecture today, drawnEvery source, pipeline and destination, as it actually flows.
- The waste mapWhere you pay for data nobody reads, and what it costs you each year.
- Costs before and after, with estimatesWhat you spend now, and what the same coverage would cost.
- Your target architectureWhat your Cribl estate could look like, drawn on your own sources.
- Options for your business problemNot one product. The choices, with what each one costs and changes.
Who does it
A lead architect with 26 years in monitoring and observability, leading a team of senior engineers in telemetry engineering and pipeline design. The team that reviews it is the team that would build it.
What it takes from you
Your diagrams and one call. No system access.
What comes next
If it pays, a two-week proof of value on your noisiest source, free unless you go ahead. At least 20% less into your SIEM, every alert kept, proved on your data.
What it costs
Nothing
No strings attached. You keep the drawing, whatever you decide.
05Questions
What Cribl teams ask before they book
We already run Cribl. What is left to buy?
The system around it: pipelines as code in your repositories, per-source reduction worked against your top talkers with results measured, a Lake that is partitioned and enriched rather than parked, and the agent phases that stand on that foundation. The engine you have is the prerequisite, not the finish line.
How is Cribl work priced?
A fixed-price foundation project, then per source, typically one to two weeks each, with acceptance criteria agreed in writing before each source starts. The first source proves the method end to end before the rollout continues. Real quotes follow the review and discovery.
Does Logmetry sell Cribl licenses?
The Cribl subscription is in your name, bought from Cribl, its channel or through Logmetry where we resell it, and priced on its own line. Cribl supports its own software under that subscription. Around it we design and build the pipelines, the reduction, and the code you own after.
Who does the work?
Senior engineers in telemetry engineering and pipeline design build it, under the direction of our lead architects. The lead architects who scope your engagement lead it to handover, and are named in the contract as key personnel.
What have peers measured with Cribl?
As Cribl published it, each figure with its name. TransUnion took DNS and Sysmon from about 1 TB a day to about 150 GB, about 85 percent (Cribl case study, 29 August 2023). Yale New Haven Health cut Palo Alto log volume 40 percent, from 600 to 700 GB a day down to 400 GB (Cribl case study, 8 July 2024). Nutanix brought firewall log volume down 50 percent (Cribl customers page, read September 2026). Those are their estates. Yours is measured on your own data, in the two-week proof, before anything moves.
Why is the review free?
Because the drawing is how you judge us. You see your own architecture, your waste and your options before you spend anything, and you keep the drawing whatever you decide. No system access, no obligation.
What if the savings don’t hold on our data?
You see it measured before you commit. The two-week proof of value runs on your noisiest source, with success criteria signed before it starts, measured in your SIEM’s own license usage view. At least 20% less into your SIEM, every alert kept, proved on your data.
See your Cribl estate drawn, with the costs, before you spend anything
Run by a lead architect with 26 years in monitoring and observability. No system access, no charge, no obligation.
Free. No system access. No obligation. You keep the drawing.
What you get
- Your architecture today, drawn
- The waste map
- Costs before and after, with estimates
- Your target architecture
- Options for your business problem
What it costsNothing