About the Integration:
Cribl Stream enables security teams to route their raw audit logs to AlphaSOC to flag both known and unknown emerging threats. By shifting expensive data normalization, enrichment, and detection tasks “left” to a dedicated threat detection engine running on-stream with Cribl you can cut unnecessary licensing and maintenance costs across your SOC.
Cribl and AlphaSOC provide fast, cost-effective detection coverage for modern security teams. We leverage open standards (namely OCSF and Sigma) to make detection-as-code, threat hunting, triage, and investigations within your existing SIEM, SOAR, and AI SOC tools easy.
Benefits:
Uncover the hidden threats in your cloud, application, network, and endpoint logs with AlphaSOC’s in-built threat intelligence, patented analytics stack, and managed detections.
Offload expensive data normalization, enrichment, and detection tasks to an optimized, dedicated platform to reduce costs and maintenance overhead.
Leverage native detection-as-code support to run custom Sigma rules without having to translate them to proprietary SIEM query formats first (e.g., CQL, KQL, or SPL).
Explore AlphaSOC findings and evidence in OCSF format using your existing SIEM, SOAR, and AI SOC tools to drive triage, investigations, and threat hunting.
How to Get Data Flowing:
Within Cribl Stream, select a Worker Group, then navigate to Routing -> QuickConnect -> Add Destination and select AlphaSOC from the list.
Under the General Settings tab set an arbitrary Output ID value and set the AlphaSOC bucket name to `events`.
Generate your S3 credentials within the AlphaSOC web console. If you do not have an AlphaSOC account, you can set one up for free.
Under the Authentication tab paste in your S3 credentials to authenticate.
Route the cloud, network, endpoint, and application logs you want AlphaSOC to process.
How to Work with AlphaSOC Findings in Cribl Search:
Use the AlphaSOC Findings Rest Collector IO pack to route findings to Cribl Lake.
Install the AlphaSOC for Cribl Search pack to render findings from Cribl Lake.