Content Factory℠ Custom Cribl App

Cribl is only as useful as the content running on it. A source with no collector, a vendor log with no breaker, or a health question with no dashboard all end up as engineer hours spent on glue instead of outcomes.

The Content Factory℠ is how VisiCore builds that glue once, properly, and hands it over as a versioned artifact your team can install, read and extend. Our Slack, Webex, SailPoint and Checkmarx collectors, Field Encryption pack, CriblVision, Lake and Search Credit Usage and Lookup Sync apps all came out of it.

• A purpose-built app for your question, running inside Cribl
• Built by the team behind CriblVision, Lake Credit Usage, Search Credit Usage and Lookup Sync
• Dashboards and alerts tested against your live data before hand-over
• Yours to keep private, or published to Cribl Community under VisiCore's or your name

Service

Content Factory℠ Custom Cribl App

Part number

VC-PS-CF-APP

Platforms

Cribl

Engagement

Fixed-scope project, 90 days service period

Pricing

Stated on the Order Form. Request a quote.

Content Factory℠ Custom Cribl App is a fixed-scope engagement that delivers one Cribl App built on Cribl's app framework. An app packages a data layer, dashboards, alerts or scheduled checks and documentation so a team can monitor, visualize and act on Cribl data without leaving Cribl.

The app is delivered as a versioned artifact. You can keep it private to your organization or have VisiCore publish it to Cribl Community, under VisiCore's name or yours.

VisiCore delivers this service remotely through scheduled working sessions led by a named VisiCore engineer who holds current Cribl and/or Splunk certifications. On-site days can be added under a separate order.

Unless agreed otherwise in writing, the engagement starts within one week of VisiCore accepting the signed order. The working schedule is set at the kickoff meeting.

VisiCore provides an agenda before each session, including which of your team members should attend. Sessions run one to four hours.

Every task, decision and deliverable is tracked as a ticket in the X10 client portal, so your team always has a current record of what was done and why.

Scope summary. The base scope below, delivered in approximately 8 working sessions.

• Scoping session: the question the app answers, data sources inside Cribl, audience, and acceptance criteria per dashboard and alert
• Data layer: searches, datasets and lookups the app depends on
• Dashboards with filters and drill-downs, built for the agreed audience
• Alerts or scheduled checks with notification targets configured in your environment
• App documentation: installation, configuration, permissions and upgrade notes; semantic versioning
• Testing against live data in your Cribl environment
• Hand-over session and two revisions within 30 days of hand-over
• Optional publication to Cribl Community, under VisiCore's or your name

Quantities

Deliverables

• Scoping notes with the app's purpose, data dependencies and acceptance criteria
• The Cribl App as a versioned package, installed in your environment
• Dashboards and alerts validated against live data
• App documentation with installation, configuration, permissions and upgrade notes
• Hand-over session recording and maintenance notes in the X10 portal
• Cribl Community listing, if publication is chosen

Planning schedule for a typical engagement. The actual schedule is agreed at kickoff; hours are estimates of effort per session, not a guaranteed number of service hours.

VisiCore Technology Group provides the services described in this brief under the applicable Order Form and the VisiCore Master Services Agreement, or another written agreement in place between VisiCore and the customer.

Session and hour counts in this brief are planning estimates for the work described, not a guarantee of a fixed number of service hours.

Pricing is stated on the Order Form. Contact VisiCore for a quote.

The following are not included unless added to the Order Form:

• Installation, modification or maintenance of customer hardware, operating systems, containers, firewalls or load balancers
• Changes to the configuration of source or destination systems outside the platform in scope
• Backup and recovery, or day-to-day maintenance, of the customer's environment
• Performance testing and benchmarking
• Formal product training beyond the guidance given in working sessions
• Any service or activity not explicitly listed in the Scope section of this brief
• Ongoing maintenance of the app after the 30-day revision window (see Resident Engineer)
• Onboarding new data into Cribl so the app has something to show (see Cribl Activation or Growth Activation)
• Dashboards or alerts in Splunk or another platform (see Resident Engineer or a custom SOW)
• Apps that depend on Cribl features not available in your edition or version

90 days.

• The customer has 90 days from the start date (the "Service Period") to schedule and use the services in this brief.
• The service ends automatically at the close of the Service Period unless VisiCore agrees in writing to extend it.
• Unused portions of the service are non-refundable and non-creditable.
• VisiCore may deliver services after the Service Period if the customer gives written notice at least 30 days before it ends and VisiCore agrees.

To deliver this service on schedule, the customer agrees to:

• Name an engagement lead with the authority to make decisions and accept deliverables
• Provide the accounts, access and network connectivity VisiCore engineers need before the first working session
• Attend scheduled sessions (one to four hours each) and complete prerequisite work before them
• Bring the subject-matter experts who own the systems being integrated
• Review each deliverable within five business days of hand-off. Without written feedback in that window the deliverable is accepted; non-blocking issues are handled after acceptance
• Provide API documentation, credentials for a non-production account where possible, and representative sample data with no personal data before the build sessions
• Provide a Cribl environment (Stream worker group or Cribl.Cloud organization) where the artifact can be installed and tested against live data
• Decide before hand-over whether the artifact stays private or is published, and under whose name

Meetings are scheduled at mutually agreed times during VisiCore business hours.

The customer must give at least 48 hours' written notice to cancel, reschedule or shorten a scheduled meeting. Without that notice, VisiCore may count the meeting as delivered.