Cribl Stream

No entries match these filters. Clear filters

1. changelog Oct 29, 2026 · issue 125

   Cribl Stream adds a Microsoft 365 Copilot Source and a Microsoft Fabric Real-Time Intelligence destination for telemetry collection and routing.

   • New integrationCribl Stream adds a Microsoft Copilot Source that collects Microsoft 365 Copilot interaction data — including user prompts and Copilot responses — from the Microsoft 365 Copilot Interaction Export API, running scheduled collection jobs per user with pagination support and built-in progress tracking so later runs focus on newer interactions.
   • New integrationCribl Stream adds a dedicated Microsoft Fabric Real-Time Intelligence destination, enabling Stream-managed data to be sent into Fabric real-time analytics workflows for event-driven scenarios, streaming data, and logs.

   2 details in Everything

2. changelog Oct 13, 2026 · issue 109

   Cribl StreamAI routes AI model traffic, applies security/spend controls, and emits normalized telemetry into the existing Cribl platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Introduces Cribl StreamAI, an AI gateway that routes requests across models, applies security and spending controls, and records model calls and routing decisions as normalized telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports outputting AI inference telemetry in OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work., UDM, and ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. schemas (or a custom schema) for routing to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., observability platform, or archive.
   • Enables smart routing of AI requests across models based on task, balancing quality, performance, and cost rather than hard-coding applications to a single model.
   • Adds the Cribl App for AI Observability, providing a focused view into AI usage, performance, and cost within the broader telemetry platform.
   • When enabled, applies redaction, filtering, and routing policies to AI request content so sensitive text reaches only approved destinations.

   +1 more show less

   • Integrates AI inference records alongside existing security data sources — including Microsoft Entra via Azure Event Hubs, syslog, CrowdStrike FDR, and AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions./VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Flow Logs — for cross-domain investigation in Cribl Search.
   • Introduces Cribl StreamAI, an AI gateway that routes requests across models, applies security and spending controls, and records model calls and routing decisions as normalized telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports outputting AI inference telemetry in OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work., UDM, and ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. schemas (or a custom schema) for routing to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., observability platform, or archive.
   • Enables smart routing of AI requests across models based on task, balancing quality, performance, and cost rather than hard-coding applications to a single model.
   • Adds the Cribl App for AI Observability, providing a focused view into AI usage, performance, and cost within the broader telemetry platform.
   • When enabled, applies redaction, filtering, and routing policies to AI request content so sensitive text reaches only approved destinations.

   1 more in Everything

3. changelog Oct 1, 2026 · issue 092

   Cribl launches the Gigamon Network Observability App, bringing deep-packet-inspection network metadata into Cribl Search, Lake, and dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds the Gigamon Network Observability App for Cribl, available in the Cribl Marketplace, integrating Gigamon Application Metadata Intelligence (AMI) network-derived telemetry into Cribl workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Provides prebuilt parsing, normalization, dashboards, saved searches, and investigation workflows designed around Gigamon AMI network telemetry inside Cribl.
   • Enables retention of rich AMI datasets in Cribl Lake while selectively routing subsets to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., observability, and other analytics platforms based on per-use-case needs.
   • Surfaces Gigamon network-derived telemetry — covering DNS activity, TLS sessions, HTTP transactions, database interactions, and file operations — through Cribl Search alongside firewall, identity, and cloud telemetry.
   • Extends network-derived telemetry visibility to unmanaged devices such as IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure., OT, and appliances by using Gigamon's agent-independent deep packet inspection across Layer 4 through Layer 7 traffic.

   5 details in Everything

4. changelog Sep 24, 2026 · issue 085

   Cribl Stream adds a Databricks Zerobus Destination to route telemetry directly into Delta TablesDelta TablesAn open-source storage format maintained by the Linux Foundation that layers ACID transactions and versioned history onto Parquet files, letting tools query, update, and time-travel through large datasets reliably. via gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. without intermediate object storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds the Databricks Zerobus Destination, routing events from Cribl Stream pipelines directly into Databricks Delta Tables via Databricks Zerobus Ingest over gRPC with JSON records, eliminating the need for an intermediate S3/Blob staging bucket and separate ingestion job.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports catalog.schema.table targeting so operators can route different telemetry streams to specific Unity Catalog Delta Tables from within existing Stream pipeline configuration.
   • Supports Databricks service-principal authentication scoped to a Unity Catalog table, aligning data movement with existing Databricks governance policies.
   • Exposes connection testing and destination metrics (throughput, errors, insertion latency) for the new Databricks destination inside the Cribl Stream operating experience.
   • Provides batching and flush controls on the Databricks Zerobus Destination to let operators tune delivery throughput and latency for high-volume enterprise telemetry workloads.

   5 details in Everything

5. changelog Sep 17, 2026 · issue 077

   Cribl Apps reach GA in 4.20 with backend functions: HTTP endpoints and scheduled jobs for custom app workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds onRequest handler model to Cribl Apps, letting developers expose app-specific HTTP endpoints that run server-side logic without a user session active.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds scheduled function support to Cribl Apps, enabling recurring background jobs such as periodically pulling from a threat feed, updating a Stream lookup table, and making the latest entries available to a pipeline for enrichment.
   • Promotes Cribl Apps to general availability, making them a supported foundation for building and deploying custom applications on Cribl Stream.
   • Adds AWS Cloud Connections recommendations in Cribl Stream, which suggests a ranked list of AWS log sources to onboard, Source configuration values, and a Destination from those available in the Worker Group.
   • Adds onRequest handler model to Cribl Apps, letting developers expose app-specific HTTP endpoints that run server-side logic without a user session active.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds scheduled function support to Cribl Apps, enabling recurring background jobs such as periodically pulling from a threat feed, updating a Stream lookup table, and making the latest entries available to a pipeline for enrichment.
   • Adds AWS Cloud Connections recommendations in Cribl Stream, which suggests a ranked list of AWS log sources to onboard, Source configuration values, and a Destination from those available in the Worker Group.

   1 more in Everything