Cribl Stream^™ Use Case:
Replay Data From Low-Cost Storage

Meeting complex compliance requirements, successful security breach forensics, and business scenario analysis all have something in common: they are easiest if you store as much data as possible for as long as possible. But keeping all data in “hot” or even “warm” storage is expensive, especially storage that backs SIEMs and UEBA tools. Stream lets you route a full-fidelity copy of raw data to low-cost storage — and then, with a couple keystrokes, retrieve and “replay” it to analytics tools to answer questions you didn’t predict ahead of time.

Knowing what data you might need ahead of time is impossible, but using Stream means you don’t have to have a crystal ball–keep it all and stream back only what you need, when you find out you need it.