Cribl Growth Activation Advanced

An additional Cribl purchase only pays for itself once the new sources are flowing and the new teams are self-sufficient. Without dedicated time that work competes with daily operations and slips for months.

Cribl Growth Activation gives your team a VisiCore certified engineer for 90 days to review what you have, fix what needs fixing, and land the new use cases on a deployment that is ready to carry them.

• Current and target-state architecture, so the deployment is ready for where you are heading
• Three new use cases live in 90 days or less
• New sources, destinations and teams onboarded with the conventions you already use
• Your team keeps extending the platform after we leave

Service

Cribl Growth Activation – Advanced

Part number

VC-PS-GRO-ADV

Family

Cribl Growth Activation

Platforms

Cribl

Engagement

Fixed-scope project, 90 days service period

Pricing

Stated on the Order Form. Request a quote.

Cribl Growth Activation is a fixed-scope consulting engagement for organizations that already run Cribl and are expanding it. A VisiCore engineer works alongside your team to evaluate the current architecture, understand your expansion goals and adapt the environment: optimizing data flows, onboarding new sources and destinations, and enabling additional teams.

The engagement starts from your deployment as it is today. Nothing is rebuilt from scratch; the work is to extend it well and leave your team able to keep extending it.

VisiCore delivers this service remotely through scheduled working sessions led by a named VisiCore engineer who holds current Cribl and/or Splunk certifications. On-site days can be added under a separate order.

Unless agreed otherwise in writing, the engagement starts within one week of VisiCore accepting the signed order. The working schedule is set at the kickoff meeting.

VisiCore provides an agenda before each session, including which of your team members should attend. Sessions run one to four hours.

Every task, decision and deliverable is tracked as a ticket in the X10 client portal, so your team always has a current record of what was done and why.

Scope summary. The base scope below plus 3 customer-chosen use cases, delivered in approximately 16 working sessions.

• Architecture optimization review of the existing deployment: sizing, worker groups, routing, pipelines, queues and destinations, with written recommendations
• Use-case workshop: requirements, success criteria and priority for each use case tied to the new purchase
• Use-case enablement: onboarding the new data sources, configuring the new destinations, and bringing new teams onto the platform
• Execution support: configuring, validating and optimizing each addition on live data
• Strategic guidance: how the expanded deployment supports your broader data, security and cost goals
• Documentation refresh covering the additions and any changes made during the review
• Knowledge transfer in every working session, with recordings where permitted
• A data source is a unique system or platform type (for example Palo Alto firewalls, Windows Event Logs or Linux syslog), not an individual device or protocol.
• Target-state architecture: a documented design for the deployment after the expansion, including sizing and routing changes needed to support it

Quantities

Deliverables

• Architecture review report with prioritized recommendations
• Use-case definitions with acceptance criteria
• New sources, destinations, routes and pipelines live in production for the in-scope use cases
• Refreshed as-built documentation
• Team enablement sessions for the groups being onboarded
• Session recordings and knowledge-transfer notes in the X10 portal

VisiCore Technology Group provides the services described in this brief under the applicable Order Form and the VisiCore Master Services Agreement, or another written agreement in place between VisiCore and the customer.

Session and hour counts in this brief are planning estimates for the work described, not a guarantee of a fixed number of service hours.

Pricing is stated on the Order Form. Contact VisiCore for a quote.

The following are not included unless added to the Order Form:

• Installation, modification or maintenance of customer hardware, operating systems, containers, firewalls or load balancers
• Changes to the configuration of source or destination systems outside the platform in scope
• Backup and recovery, or day-to-day maintenance, of the customer's environment
• Performance testing and benchmarking
• Formal product training beyond the guidance given in working sessions
• Any service or activity not explicitly listed in the Scope section of this brief
• Custom scripting to pull or push data from systems that have no native Cribl integration (see Content Factory: Custom Pack)
• CI/CD or infrastructure-as-code automation of the Cribl deployment (available as a custom SOW)
• Migration of existing content from another platform (see SIEM Migration and Cribl Search Activation)
• Re-architecting or rebuilding the existing deployment from scratch (see Cribl Activation)

90 days.

• The customer has 90 days from the start date (the "Service Period") to schedule and use the services in this brief.
• The service ends automatically at the close of the Service Period unless VisiCore agrees in writing to extend it.
• Unused portions of the service are non-refundable and non-creditable.
• VisiCore may deliver services after the Service Period if the customer gives written notice at least 30 days before it ends and VisiCore agrees.

To deliver this service on schedule, the customer agrees to:

• Name an engagement lead with the authority to make decisions and accept deliverables
• Provide the accounts, access and network connectivity VisiCore engineers need before the first working session
• Attend scheduled sessions (one to four hours each) and complete prerequisite work before them
• Bring the subject-matter experts who own the systems being integrated
• Review each deliverable within five business days of hand-off. Without written feedback in that window the deliverable is accepted; non-blocking issues are handled after acceptance
• Provide administrative access to the existing Cribl deployment, or a Cribl diag bundle, before the architecture review session
• Provide representative sample data for the new sources, with no personal data, so engineers can build pipelines offline between sessions
• Use cases are defined in the workshop. A use case can be swapped only before work on it has started

Meetings are scheduled at mutually agreed times during VisiCore business hours.

The customer must give at least 48 hours' written notice to cancel, reschedule or shorten a scheduled meeting. Without that notice, VisiCore may count the meeting as delivered.