The speaker, Ben, is a senior lead security engineer in the telecommunication sector with over 15 years of industry experience. He uses Cribl to help with Security Information and Event Management (SIM) deployments and to optimize security stacks.
The main use case for Cribl is reducing cost. The speaker's company uses Cribl Stream and Edge, which are mainly deployed on-premise. Cribl Stream is used for optimization work, such as reducing the amount of data. They reduce costs by using Cribl to control which data is sent to the Security Information and Event Management (SIM). Specifically, they use Cribl's aggregation and drop functions to cut down noise from very "chatty" logs, such as firewall and other network logs, while sending a full copy of the data to S3 or a data lake and a reduced log to the SIM.
Key results and comparisons:
Cost Savings: Introducing Cribl brought down the cost of their SIM. The company was able to save almost 48% of their total cost.
Deployment Cost: Getting the entire Cribl infrastructure set up incurred little to no cost.
Onboarding Time: Prior to Cribl, onboarding a client could take about a week or more, depending on the data's complexity and volume. With Cribl Stream, they can now get these tasks done in a couple of hours and sometimes in less than a day.
Previous Tools: Before Cribl, they used SC4s and heavy forwarders to write transformations and properties to reduce data, but it was "not doing quite a very good job".
Functionality: Cribl's advanced functionalities, like aggregation and drop functions, were very easy to configure, unlike the heavy forwarders, where building transformations was sometimes very difficult.
The company has also integrated AI into most of its tools, and Cribl is one of the tools in the pipeline for this. Integrating AI is expected to cut down the time admins spend on quickly building packs or pipelines for data sources.
The speaker recommends Cribl to companies "drowning in data and cost" because it allows them to take full control of their data and makes things much easier.