Cribl Stream helps you gain more insight from the data you already have, adapt to new tools without re-instrumenting, and build an Al-ready telemetry foundation with choice and control at every step.
The challenge
IT and security teams need to manage a tidal wave of machine-generated data while supporting more tools, more environments, and more Al-powered workflows. Telemetry growth is outpacing budgets and legacy architectures, and fragmented formats make it harder to turn data into decisions. Teams need visibility and readiness, not another silo.
The solution
Cribl Stream gives organizations a vendor-agnostic control layer for telemetry in motion. Take data from any source and parse, transform, enrich, reduce, normalize, and route it to any destination. Keep full-fidelity data in low-cost storage and replay it when new questions arise. With Cribl's Al Platform for Telemetry, Stream also prepares data for the people, agents, and Al-powered applications that depend on it.
Cribl Stream features and capabilities
COLLECTION AND REPLAY
Use Stream as a universal receiver for logs, metrics, traces, events, APls, and batch data. Onboard sources quickly with Packs, recall data from Cribl Lake or other storage, and replay it into analytics tools when investigations evolve.
STREAM PACKS
Packs are predefined sets of sources, destinations, routes, pipelines, data samples, lookups, and other knowledge objects built around common use cases. Packs can be downloaded from the Cribl Marketplace and implemented within your Stream instances. Users can also create new Packs to easily share functionality between Leader nodes and Worker groups, while maximizing the value of your Stream investment.
SHAPE AND PREPARE YOUR DATA
Translate and transform telemetry into the formats your tools expect. Use Pipeline Builder to create and modify pipelines with natural language, and use Al-guided schema mapping to normalize data to industry standards such as OCSF, ECS, and UDM, including support for custom schemas.
ROUTE THE CLEANEST DATA TO THE RIGHT DESTINATIONS
Filter noise, remove duplicate or low-value fields, sample events, aggregate logs into metrics, and route each dataset to the right destination. Keep a full-fidelity copy for retention, compliance, and future replay. StreamAI extends Cribl's routing and control model to Al inference, routing requests to the right model while bringing Al activity into the telemetry environment.
PROTECT THE DATA IN MOTION
Cribl Guard uses Al to detect sensitive data as it flows through Stream, with human-in-the-loop review and pipeline-native controls for masking or blocking. This helps teams improve risk visibility and prepare trusted telemetry for Al-powered workflows and investigations.
OPERATE WITH MORE CONTROL, CHOICE, AND SCALE
Reduce management overhead with GUI-based configuration, testing, real-time monitoring, graphical data flow mapping, automated upgrades, and role-based access control. Deploy Stream on-premises, in a hybrid
environment, or in Cribl.Cloud.
