Services
We design, implement, maintain and troubleshoot your data infrastructure.
Deep expertise with Cribl and Splunk. An elite partner with real-world experience across Sec Ops, IT and Observability, from initial tech selection through production and management. 22 packaged services with published scope, or a custom statement of work when the job does not fit a box.
Certified across the stack
Packaged services
Fixed scope. Published briefs. No surprises.
Every package below is a published service brief: what is in scope, what is not, how long it runs and what we need from you. Pick a tier, read the brief, and the Order Form covers the rest. Delivered by Cribl and Splunk certified engineers and tracked in the X10 client portal.
Three ways to work with us
Swipe sideways to compare all three models →
| Engagement model | Professional Services | Subscription Services | Managed Solutions |
|---|---|---|---|
| Best for | A defined project with a start and an end | Steady capacity from an engineer who knows your estate | Handing us the day-to-day running of Splunk and Cribl |
| Packaged as | Fixed-scope service briefs (Activation, Migration, Health Check, Content Factory) | Resident Engineer tiers on X10 credits | Managed Solutions, sized at scoping |
| Customization | High | Medium | High |
| Ongoing support | Limited to the service period | Includedmonthly allotment | Includedcontinuous |
| Time to value | Fast | Consistent | Immediate |
| Certified engineers | Included | Includednamed | Includeddedicated team |
| Tracked in the X10 portal | Included | Included | Included |
| Cost model | Per package | Predictable monthly | Comprehensive monthly |
- Cribl
Cribl Activation
From signed order to a documented production Cribl deployment in 90 days or less, with your team trained to run it.
3 tiers · fixed scope
- EssentialsA production Cribl deployment with two use cases live, documented and handed over in 90 days.
VC-PS-ACT-ESS- 2 use cases
- Data sources: 5
- Destinations: 2
- Worker groups / Edge fleets: 1
- AdvancedRecommendedThree use cases, two worker groups, and a Resident Engineer for three months after you go live.
VC-PS-ACT-ADV- 3 use cases
- Data sources: 10
- Destinations: 4
- Worker groups / Edge fleets: 2
- EnterpriseFive use cases, HA/DR designed in, an Edge fleet if you need one, and six months of Resident Engineer support.
VC-PS-ACT-ENT- 5 use cases
- Data sources: 20
- Destinations: 6
- Worker groups / Edge fleets: 4, or one Edge fleet
Swipe sideways to compare →
| Scope | Essentials | Advanced | Enterprise |
|---|---|---|---|
| Use cases | 2 | 3 | 5 |
| Working sessions | ~12 | ~20 | ~30 |
| Data sources | 5 | 10 | 20 |
| Destinations | 2 | 4 | 6 |
| Worker groups / Edge fleets | 1 | 2 | 4, or one Edge fleet |
| HA / DR design | Not included | Not included | Included |
| Resident Engineer after activation | Not included | 2 sessions / month · 3 months | 4 sessions / month · 6 months |
| Service period | 90 days | 90 days | 90 days |
- Cribl
Cribl Growth Activation
Already running Cribl and just bought more? Turn the new capacity into live use cases, new sources and new teams in 90 days.
3 tiers · fixed scope
- EssentialsA current-state review and two new use cases live on your existing Cribl deployment in 90 days.
VC-PS-GRO-ESS- 2 use cases
- New data sources: 5
- New destinations: 1
- Architecture review: Current state
- AdvancedRecommendedCurrent and target-state architecture, three new use cases, and two teams brought onto the platform.
VC-PS-GRO-ADV- 3 use cases
- New data sources: 10
- New destinations: 2
- Architecture review: Current + target state
- EnterpriseFive new use cases, multi-region architecture, an Edge fleet expansion plan and a FinOps review of your credits.
VC-PS-GRO-ENT- 5 use cases
- New data sources: 20
- New destinations: 4
- Architecture review: Current + target state, multi-region
Swipe sideways to compare →
| Scope | Essentials | Advanced | Enterprise |
|---|---|---|---|
| Use cases | 2 | 3 | 5 |
| Working sessions | ~10 | ~16 | ~24 |
| New data sources | 5 | 10 | 20 |
| New destinations | 1 | 2 | 4 |
| Architecture review | Current state | Current + target state | Current + target state, multi-region |
| Team enablement sessions | 1 | 2 | 4 |
| Edge fleet expansion plan | Not included | Not included | Included |
| FinOps and credit review | Not included | Not included | Included |
| Service period | 90 days | 90 days | 90 days |
- Cribl
Cribl Search Activation
Land your data in Cribl Lake or object storage and move the searches, alerts and dashboards your teams rely on into Cribl Search.
3 tiers · fixed scope
- EssentialsYour first eight datasets in Cribl Search with the searches and dashboards that matter most moved over.
VC-PS-SRCH-ESS- Data sources onboarded: 8
- Saved searches and alerts migrated: 25
- Dashboards migrated: 5
- AdvancedRecommendedFifteen datasets, sixty searches and alerts, ten dashboards, and your team trained on operations, RBAC and data lifecycle.
VC-PS-SRCH-ADV- Data sources onboarded: 15
- Saved searches and alerts migrated: 60
- Dashboards migrated: 10
- EnterpriseTwenty-five datasets, a hundred and twenty-five searches and alerts, twenty dashboards, and your existing agents converted to Cribl Edge.
VC-PS-SRCH-ENT- Data sources onboarded: 25
- Saved searches and alerts migrated: 125
- Dashboards migrated: 20
Swipe sideways to compare →
| Scope | Essentials | Advanced | Enterprise |
|---|---|---|---|
| Working sessions | ~10 | ~18 | ~28 |
| Data sources onboarded | 8 | 15 | 25 |
| Saved searches and alerts migrated | 25 | 60 | 125 |
| Dashboards migrated | 5 | 10 | 20 |
| Agent-to-Edge conversion | Not included | Not included | Included |
| Enablement | Introductory | Operations, RBAC and data lifecycle | Operations, RBAC, lifecycle and governance |
| Service period | 90 days | 90 days | 90 days |
- Cribl
- SIEM
SIEM Migration
Change SIEMs without re-plumbing every source. Cribl decouples collection from the destination, so the move is a routing change, not a rebuild.
3 tiers · fixed scope
- EssentialsA focused migration of your highest-value sources and detections to one new SIEM, with Cribl in front.
VC-PS-SIEM-ESS- Data sources migrated: 10
- Detections or saved searches ported: 25
- Dashboards rebuilt: 5
- AdvancedRecommendedThe standard enterprise migration: a two-week parallel run, an archive tier in object storage, and the content most SOCs actually depend on.
VC-PS-SIEM-ADV- Data sources migrated: 25
- Detections or saved searches ported: 75
- Dashboards rebuilt: 15
- EnterpriseMulti-region or multi-tenant migration with an Edge rollout, a four-week parallel run and the full detection estate.
VC-PS-SIEM-ENT- Data sources migrated: 50
- Detections or saved searches ported: 150
- Dashboards rebuilt: 30
Swipe sideways to compare →
| Scope | Essentials | Advanced | Enterprise |
|---|---|---|---|
| Working sessions | ~14 | ~26 | ~40 |
| Data sources migrated | 10 | 25 | 50 |
| Detections or saved searches ported | 25 | 75 | 150 |
| Dashboards rebuilt | 5 | 15 | 30 |
| Destinations | 1 | 1, plus archive to object storage | Up to 3 (multi-region or multi-tenant) |
| Parallel-run period | Not included | 2 weeks | 4 weeks |
| Edge rollout | Not included | Not included | Included |
| Service period | 90 days | 120 days | 6 months |
Point services
One job, done properly
Single-SKU engagements with a defined start, end and deliverable. Health checks come with a prioritized fix list; migrations come with a cutover plan and hypercare.
- Cribl Deployment Health Check
- Cribl
VC-PS-HC-CRIBLRemote review of a single Cribl Stream or Edge environment across ten areas, from architecture to performance metrics, ending in a written health report with prioritized recommendations.
View brief → - Splunk Health Check & Optimization
- Splunk
VC-PS-HC-SPLKRemote review of one Splunk Cloud or Enterprise deployment across architecture, indexing and licence, search load, knowledge objects, ES and ITSI content, onboarding hygiene, version posture and access, ending in a prioritized fix list.
View brief → - Cribl.Cloud Migration
- Cribl
- Cloud
VC-PS-MIG-CRIBLMigration of a self-hosted Cribl Stream or Edge deployment to Cribl.Cloud: configuration export, test import, validation and a coordinated cutover for up to five worker groups.
View brief → - Splunk Cloud Migration
- Splunk
- Cloud
VC-PS-MIG-SPLKMigration of a Splunk Enterprise deployment to Splunk Cloud: readiness assessment, app vetting and remediation, knowledge-object and role migration, forwarder cutover, parallel validation and hypercare, for up to fifty indexes, twenty-five apps and two terabytes a day.
View brief →
Content Factory℠
Custom Packs and Apps for your data
Every organization has unique data needs, that’s where the Content Factory℠ comes in. We design and deliver custom Packs that pull, shape, transform, enrich, and route your data, and custom Cribl Apps that monitor, visualize, and act on it, right inside Cribl.
Many of our Apps and Packs are open source on Cribl Community and the Cribl Packs Dispensary: CriblVision, Lake and Search credit usage, Lookup Sync, and collectors for Slack, Webex, SailPoint, Checkmarx and Cribl Billing.
- Content Factory℠ Custom Pack
- Cribl
VC-PS-CF-PACKA custom Cribl Pack for a source Cribl does not cover out of the box: REST or other collector, event breakers, parsing and enrichment pipeline, routes, sample data and README. Private to your org or published to the Dispensary.
View brief → - Content Factory℠ Custom Cribl App
- Cribl
VC-PS-CF-APPA custom Cribl App built on Cribl's app framework: data layer, up to five dashboards, up to five alerts or scheduled checks, and documentation. Private to your org or published to Cribl Community.
View brief →
Ongoing
Keep an engineer on the team, or hand us the keys
Subscription Services put a named VisiCore engineer inside your team on predictable X10 credits. Managed Solutions means we run the Splunk and Cribl estate for you.
- Cribl
- Splunk
Resident Engineer
A named VisiCore engineer embedded with your team, on a predictable monthly allotment, with every task tracked as a ticket in the X10 portal.
3 tiers · 12-month term
- EssentialsTwenty hours a month with a named engineer: two scheduled sessions plus portal tickets for everything in between.
VC-SS-RE-ESS- Hours per month: 20
- Scheduled working sessions per month: 2
- Named engineer
- AdvancedRecommendedForty hours a month: weekly sessions, next-business-day tickets, upgrades executed in your window, and a quarterly architecture review.
VC-SS-RE-ADV- Hours per month: 40
- Scheduled working sessions per month: 4
- Named engineer
- EnterpriseEighty hours a month, roughly two days a week: a primary engineer plus a named backup, same-day tickets, and upgrades with rollback planning.
VC-SS-RE-ENT- Hours per month: 80 (about two days a week)
- Scheduled working sessions per month: 8
- Named engineer: Primary plus named backup
Swipe sideways to compare →
| Scope | Essentials | Advanced | Enterprise |
|---|---|---|---|
| Hours per month | 20 | 40 | 80 (about two days a week) |
| Scheduled working sessions per month | 2 | 4 | 8 |
| Named engineer | Included | Included | Primary plus named backup |
| Response to portal tickets | 2 business days | 1 business day | Same business day |
| Quarterly architecture review | Not included | Included | Included |
| Upgrade planning and execution | Guidance | Guidance and execution in window | Guidance, execution and rollback planning |
| Term | 12 months | 12 months | 12 months |
Certified
Some of our certificationsCribl certified engineers on every engagement.
Custom statement of work
Does not fit a package? We scope it.Bigger environments, unusual sources, multi-year programs, or a mix of several packages. We write the SOW from the same brief template, so the scope is just as clear.
See what your data is really costing you.
Our engineers will map your data flow, identify three critical vulnerabilities, and hand you a prioritized fix list. No sales pitch.
Schedule a conversation