https://cybertoolchain.io/tools/cribl-stream New releases and features in Cribl Stream, tracked by The Cyber Toolchain. en Thu, 29 Oct 2026 00:00:00 GMT https://cribl.io/blog/taming-the-ai-data-deluge-governing-telemetry-with-cribl-and-microsoft https://cribl.io/blog/taming-the-ai-data-deluge-governing-telemetry-with-cribl-and-microsoft Thu, 29 Oct 2026 00:00:00 GMT Cribl Stream adds a Microsoft 365 Copilot interaction source and a Microsoft Fabric Real-Time Intelligence destination⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Cribl Stream adds a Microsoft Copilot Source that collects Microsoft 365 Copilot interaction data — including user prompts and Copilot responses — from the Microsoft 365 Copilot Interaction Export API, running scheduled collection jobs per user with pagination support and built-in progress tracking so later runs focus on newer interactions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Cribl Stream adds a dedicated Microsoft Fabric Real-Time Intelligence destination, enabling Stream-managed data to be sent into Fabric real-time analytics workflows for event-driven scenarios, streaming data, and logs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl-stream https://cribl.io/blog/why-ai-gateways-and-telemetry-belong-on-the-same-platform https://cribl.io/blog/why-ai-gateways-and-telemetry-belong-on-the-same-platform Tue, 13 Oct 2026 14:00:00 GMT Cribl StreamAI routes AI model traffic, applies security/spend controls, and emits normalized telemetry into the existing Cribl platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces Cribl StreamAI, an AI gateway that routes requests across models, applies security and spending controls, and records model calls and routing decisions as normalized telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports outputting AI inference telemetry in OCSF, UDM, and ECS schemas (or a custom schema) for routing to a SIEM, observability platform, or archive. • Enables smart routing of AI requests across models based on task, balancing quality, performance, and cost rather than hard-coding applications to a single model. • Adds the Cribl App for AI Observability, providing a focused view into AI usage, performance, and cost within the broader telemetry platform. • When enabled, applies redaction, filtering, and routing policies to AI request content so sensitive text reaches only approved destinations. • Integrates AI inference records alongside existing security data sources — including Microsoft Entra via Azure Event Hubs, syslog, CrowdStrike FDR, and AWS CloudTrail/VPC Flow Logs — for cross-domain investigation in Cribl Search. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl-stream https://cribl.io/blog/introducing-the-gigamon-network-observability-app-network-derived-metadata-built-on-cribls-ai-platform-for-telemetry https://cribl.io/blog/introducing-the-gigamon-network-observability-app-network-derived-metadata-built-on-cribls-ai-platform-for-telemetry Thu, 01 Oct 2026 00:00:00 GMT Cribl launches the Gigamon Network Observability App, bringing deep-packet-inspection network metadata into Cribl Search, Lake, and dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the Gigamon Network Observability App for Cribl, available in the Cribl Marketplace, integrating Gigamon Application Metadata Intelligence (AMI) network-derived telemetry into Cribl workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Provides prebuilt parsing, normalization, dashboards, saved searches, and investigation workflows designed around Gigamon AMI network telemetry inside Cribl. • Enables retention of rich AMI datasets in Cribl Lake while selectively routing subsets to SIEM, observability, and other analytics platforms based on per-use-case needs. • Surfaces Gigamon network-derived telemetry — covering DNS activity, TLS sessions, HTTP transactions, database interactions, and file operations — through Cribl Search alongside firewall, identity, and cloud telemetry. • Extends network-derived telemetry visibility to unmanaged devices such as IoT, OT, and appliances by using Gigamon's agent-independent deep packet inspection across Layer 4 through Layer 7 traffic. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl-stream https://cribl.io/blog/cribl-stream-and-databricks-a-faster-path-to-analytics-ready-telemetry https://cribl.io/blog/cribl-stream-and-databricks-a-faster-path-to-analytics-ready-telemetry Thu, 24 Sep 2026 00:00:00 GMT Cribl Stream adds a Databricks Zerobus Destination to route telemetry directly into Delta Tables via gRPC without intermediate object storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the Databricks Zerobus Destination, routing events from Cribl Stream pipelines directly into Databricks Delta Tables via Databricks Zerobus Ingest over gRPC with JSON records, eliminating the need for an intermediate S3/Blob staging bucket and separate ingestion job.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports `catalog.schema.table` targeting so operators can route different telemetry streams to specific Unity Catalog Delta Tables from within existing Stream pipeline configuration. • Supports Databricks service-principal authentication scoped to a Unity Catalog table, aligning data movement with existing Databricks governance policies. • Exposes connection testing and destination metrics (throughput, errors, insertion latency) for the new Databricks destination inside the Cribl Stream operating experience. • Provides batching and flush controls on the Databricks Zerobus Destination to let operators tune delivery throughput and latency for high-volume enterprise telemetry workloads. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl-stream https://cribl.io/blog/backend-functions-arrive-in-cribl-apps https://cribl.io/blog/backend-functions-arrive-in-cribl-apps Thu, 17 Sep 2026 07:37:40 GMT Cribl Apps reach GA in 4.20 with backend functions: HTTP endpoints and scheduled jobs for custom app workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `onRequest` handler model to Cribl Apps, letting developers expose app-specific HTTP endpoints that run server-side logic without a user session active.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds scheduled function support to Cribl Apps, enabling recurring background jobs such as periodically pulling from a threat feed, updating a Stream lookup table, and making the latest entries available to a pipeline for enrichment. • Promotes Cribl Apps to general availability, making them a supported foundation for building and deploying custom applications on Cribl Stream. • Adds AWS Cloud Connections recommendations in Cribl Stream, which suggests a ranked list of AWS log sources to onboard, Source configuration values, and a Destination from those available in the Worker Group. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cribl-stream