“WE ORIGINALLY TRIED TO DO FILTERING ON THE HEAVY FORWARDERS, SO WE WERE EXCITED TO BE ABLE TO USE CRIBL FILTER PACKS INSTEAD. AFTER A SIMPLE PLUG AND PLAY, WE WERE UP AND RUNNING IN NO TIME.”
“THE ENRICHMENT CAPABILITIES OF STREAM MAKES IT EASY TO TAG DATA CORRECTLY AT INGEST, SO IT ENDS UP IN THE RIGHT DESTINATION AT THE END OF THE DAY.”
As the head of SOC and CERT Operations and manager of incident response at TAQA Group, Andrew Ochse certainly has his hands full. The national energy provider has subsidiaries and assets globally — running critical infrastructure from headquarters to Abu Dhabi across regions from the UK and the Netherlands, all the way to Canada, India, and beyond.
With enormous amounts of data comes great responsibility — which is why Andrew has chosen to implement Cribl Stream into his monitoring and security environments. Andrew describes Stream as:
“ A pipelining technology that allows you to route data from any source to any consumer, and at the same time, filter it, clean it up, split it out, and do all kinds of funky stuff with it.”
The energy company has multiple Splunk instances in operation, and Cribl Stream serves as the data pipeline that allows them to pump all of their traffic from various geographical locations both to regional instances for compliance and remediation, as well as to their central SOC, and then to their MSSP. Because they have traffic going to and from places all over the world–sometimes from regions with very low bandwidth-–they filter data in Cribl to clean data up at the source and contain their Splunk license as much as possible.
In a recent conversation with Andrew, he described how useful Cribl packs have been to operations across the business:
“We’re using them for all the firewalls and for Windows — Palo Alto Networks, Fortigate, Cisco ASA. It would have been an absolute nightmare to manage all of them without Cribl Packs.”
If you’re running a site–to-site VPN internationally like the energy company is, compression becomes a necessity — otherwise, you could be wasting bandwidth on data you don’t really need. Because of the national importance of the data moving through their infrastructure, the team can’t afford to lose a single log, so they have some fairly large Cribl clusters running in various locations.
An added benefit for these regions with low bandwidth is Cribl Stream’s persistent queuing feature, which ensures no data is lost if networks go down. Stream spools the data (Andrew has the company’s set to retain for 7 days) and when the network comes back up the data ships to its intended destination.
“The minute we started piping stuff everywhere, we saw value instantly. It’s a product that has an immediate ROI. To give you context, I previously ran a 1.5TB Splunk license in this environment, and we were able to pull that down to a 1TB license. That’s a 33% percent savings, so Cribl more than pays for itself.”
With Cribl Stream in place, Andrew feels confident that he’s getting all the data he needs and isn’t losing anything important along the way. If you’re looking for similar warm fuzzy feelings from your infrastructure, check out our Cribl Sandboxes to learn more about our solutions, and join our community to get support from other Cribl users.
Cribl makes open observability a reality for today’s tech professionals. The Cribl product suite defies data gravity with radical levels of choice and control. Wherever the data comes from, wherever it needs to go, Cribl delivers the freedom and flexibility to make choices, not compromises. It’s enterprise software that doesn’t suck, enables tech professionals to do what they need to do, and gives them the ability to say “Yes.” With Cribl, companies have the power to control their data, get more out of existing investments, and shape the observability future. Founded in 2017, Cribl is a remote-first company with an office in San Francisco, CA. For more information, visit www.cribl.io or our LinkedIn, Twitter, or Slack community.