Cribl Brand
TRY CRIBL NOW TALK TO AN EXPERT
X
x

Case Study

How A National Energy Company Leverages Cribl Stream to Support Critical Infrastructure Around the Globe

star-round-framed
Highlights
  • Reduced Splunk license from 1.5TB to 1TB
  • Accelerated ability to filter, normalize and tag data
  • Accelerated incident detection and response
  • Resolved bandwidth issues for international, site-to-site VPN traffic

“WE ORIGINALLY TRIED TO DO FILTERING ON THE HEAVY FORWARDERS, SO WE WERE EXCITED TO BE ABLE TO USE CRIBL FILTER PACKS INSTEAD. AFTER A SIMPLE PLUG AND PLAY, WE WERE UP AND RUNNING IN NO TIME.”

“THE ENRICHMENT CAPABILITIES OF STREAM MAKES IT EASY TO TAG DATA CORRECTLY AT INGEST, SO IT ENDS UP IN THE RIGHT DESTINATION AT THE END OF THE DAY.”

Share:

Download PDF

As the head of SOC and CERT Operations and manager of incident response at TAQA Group, Andrew Ochse certainly has his hands full. The national energy provider has subsidiaries and assets globally — running critical infrastructure from headquarters to Abu Dhabi across regions from the UK and the Netherlands, all the way to Canada, India, and beyond.

With enormous amounts of data comes great responsibility — which is why Andrew has chosen to implement Cribl Stream into his monitoring and security environments. Andrew describes Stream as:

“ A pipelining technology that allows you to route data from any source to any consumer, and at the same time, filter it, clean it up, split it out, and do all kinds of funky stuff with it.”

Andrew has been routing data and doing the aforementioned “funky stuff” since the early days of Cribl. He implemented Stream while building the SOC for his organization. The energy company’s team manages and secures an air-gapped data center, while partnering with an MSSP for alerting and Tier 1 response. Cribl’s routing capability makes it possible for the right data to get to the right destination to accelerate incident detection and response–ensuring no data is lost in the process.
A Pipeline Between Heavy Forwarders and Various Splunk Instances

The energy company has multiple Splunk instances in operation, and Cribl Stream serves as the data pipeline that allows them to pump all of their traffic from various geographical locations both to regional instances for compliance and remediation, as well as to their central SOC, and then to their MSSP. Because they have traffic going to and from places all over the world–sometimes from regions with very low bandwidth-–they filter data in Cribl to clean data up at the source and contain their Splunk license as much as possible.

In a recent conversation with Andrew, he described how useful Cribl packs have been to operations across the business:

“We’re using them for all the firewalls and for Windows — Palo Alto Networks, Fortigate, Cisco ASA. It would have been an absolute nightmare to manage all of them without Cribl Packs.”

Since they’re running multiple pipelines for every data source, they also use Stream to enrich their data, tagging it correctly at ingest so that it ends up at the right index at the end of the day.
Cribl Cluster-to-Cluster Compression

If you’re running a site–to-site VPN internationally like the energy company is, compression becomes a necessity — otherwise, you could be wasting bandwidth on data you don’t really need. Because of the national importance of the data moving through their infrastructure, the team can’t afford to lose a single log, so they have some fairly large Cribl clusters running in various locations.

An added benefit for these regions with low bandwidth is Cribl Stream’s persistent queuing feature, which ensures no data is lost if networks go down. Stream spools the data (Andrew has the company’s set to retain for 7 days) and when the network comes back up the data ships to its intended destination.

Cribl Stream’s Fast Time to Value
When we asked Andrew how quickly he and his team were able to see value from Stream, he was happy to share his thoughts:

“The minute we started piping stuff everywhere, we saw value instantly. It’s a product that has an immediate ROI. To give you context, I previously ran a 1.5TB Splunk license in this environment, and we were able to pull that down to a 1TB license. That’s a 33% percent savings, so Cribl more than pays for itself.”

With Cribl Stream in place, Andrew feels confident that he’s getting all the data he needs and isn’t losing anything important along the way. If you’re looking for similar warm fuzzy feelings from your infrastructure, check out our Cribl Sandboxes to learn more about our solutions, and join our community to get support from other Cribl users.

TL;DR
  • This national energy company leverages Cribl Stream to get the right data from its sources all over the world to the right destination
  • Stream allows them to confidently route data locally, to a centralized SOC and an MSSP
  • Cribl reduction and compression capabilities resolved bandwidth issues for remote locations and high volume sources
  • Stream ensures no logs are lost during network or service provider outages
  • Cribl Packs took away need to manually code and operate data filters on heavy forwarders
  • Stream’s ability to filter data gives the national energy company more control over their Splunk license
More Customer Stories

About Cribl

Cribl makes open observability a reality for today’s tech professionals. The Cribl product suite defies data gravity with radical levels of choice and control. Wherever the data comes from, wherever it needs to go, Cribl delivers the freedom and flexibility to make choices, not compromises. It’s enterprise software that doesn’t suck, enables tech professionals to do what they need to do, and gives them the ability to say “Yes.” With Cribl, companies have the power to control their data, get more out of existing investments, and shape the observability future. Founded in 2017, Cribl is a remote-first company with an office in San Francisco, CA. For more information, visit www.cribl.io or our LinkedIn, Twitter, or Slack community.

Pixel Mask