Cribl Search Activation Essentials

Most organizations index far more data than they search. Cribl Search queries data where it sits, in Cribl Lake or your own object storage, so the data you rarely touch stops costing SIEM licence and hot storage.

The hard part is not the technology. It is moving the searches, alerts and dashboards your teams depend on without a gap in coverage. Cribl Search Activation does that work with a VisiCore certified engineer, on a fixed scope, in 90 days.

• Priority searches and dashboards running in Cribl Search in 90 days or less
• Data landed in Cribl Lake or your object storage with collection validated end to end
• Rarely searched data stops consuming SIEM licence and hot storage
• Your team can onboard the next dataset on its own

Service

Cribl Search Activation – Essentials

Part number

VC-PS-SRCH-ESS

Family

Cribl Search Activation

Platforms

Cribl

Engagement

Fixed-scope project, 90 days service period

Pricing

Stated on the Order Form. Request a quote.

Cribl Search Activation is a fixed-scope consulting engagement that onboards data into Cribl Lake or object storage and migrates content from an existing analytics or SIEM platform into Cribl Search. It combines data onboarding, content migration and enablement in four stages, whatever platform you use today.

A dedicated VisiCore engineer, certified by Cribl, plans, configures and carries out the migration with your team. By the end your prioritized content runs in Cribl Search and your team can onboard the next dataset without us.

Stage 1, migration planning and assessment: inventory existing dashboards, saved searches, alerts and workflows; review data sources, retention, access control and ingest patterns; prioritize the must-have content; map existing data to Cribl's datasets, schema and processing.

Stage 2, data collection setup: configure or validate collection into Cribl Lake or object storage (Edge, syslog, API pulls, cloud sources), handle data typing, timestamps and enrichment, and confirm the design fits your scale, availability and retention needs.

Stage 3, content migration and use-case enablement: rebuild the prioritized dashboards, searches and alerts in Cribl Search, create new or improved use cases where Search does the job better, and validate results against the source platform for accuracy and completeness.

Stage 4, education and operational enablement: train your team to onboard new datasets, maintain and extend content, manage retention and RBAC, and apply architecture and governance practices so they continue independently.

VisiCore delivers this service remotely through scheduled working sessions led by a named VisiCore engineer who holds current Cribl and/or Splunk certifications. On-site days can be added under a separate order.

Unless agreed otherwise in writing, the engagement starts within one week of VisiCore accepting the signed order. The working schedule is set at the kickoff meeting.

VisiCore provides an agenda before each session, including which of your team members should attend. Sessions run one to four hours.

Every task, decision and deliverable is tracked as a ticket in the X10 client portal, so your team always has a current record of what was done and why.

Scope summary. The base scope below, delivered in approximately 10 working sessions.

• Data collection uses Cribl's native collection methods into Cribl Lake or customer-managed object storage
• Validation of migrated content against the source platform for the datasets in scope
• Documentation of datasets, collection configuration and migrated content
• Knowledge transfer in every working session, with recordings where permitted
• A data source is a unique system or platform type (for example Palo Alto firewalls, Windows Event Logs or Linux syslog), not an individual device or protocol. A saved search and an alert each count once against the saved searches and alerts cap.

Quantities

Deliverables

• Content inventory with migration priority and data-to-dataset mapping
• Collection configuration into Cribl Lake or object storage for the in-scope data sources
• Migrated saved searches, alerts and dashboards live in Cribl Search
• Validation results comparing migrated content with the source platform
• Dataset, collection and content documentation
• Session recordings and knowledge-transfer notes in the X10 portal

VisiCore Technology Group provides the services described in this brief under the applicable Order Form and the VisiCore Master Services Agreement, or another written agreement in place between VisiCore and the customer.

Session and hour counts in this brief are planning estimates for the work described, not a guarantee of a fixed number of service hours.

Pricing is stated on the Order Form. Contact VisiCore for a quote.

The following are not included unless added to the Order Form:

• Installation, modification or maintenance of customer hardware, operating systems, containers, firewalls or load balancers
• Changes to the configuration of source or destination systems outside the platform in scope
• Backup and recovery, or day-to-day maintenance, of the customer's environment
• Performance testing and benchmarking
• Formal product training beyond the guidance given in working sessions
• Any service or activity not explicitly listed in the Scope section of this brief
• Onboarding data into Cribl Stream pipelines beyond what is needed to land it for Cribl Search (see Cribl Activation and Growth Activation)
• Migration of archival or historical data already stored in the source platform
• Decommissioning or licence changes on the source platform
• Converting existing agents or collectors to Cribl Edge. Agent replacement and large-scale endpoint rollout require the Enterprise tier or an add-on

90 days.

• The customer has 90 days from the start date (the "Service Period") to schedule and use the services in this brief.
• The service ends automatically at the close of the Service Period unless VisiCore agrees in writing to extend it.
• Unused portions of the service are non-refundable and non-creditable.
• VisiCore may deliver services after the Service Period if the customer gives written notice at least 30 days before it ends and VisiCore agrees.

To deliver this service on schedule, the customer agrees to:

• Name an engagement lead with the authority to make decisions and accept deliverables
• Provide the accounts, access and network connectivity VisiCore engineers need before the first working session
• Attend scheduled sessions (one to four hours each) and complete prerequisite work before them
• Bring the subject-matter experts who own the systems being integrated
• Review each deliverable within five business days of hand-off. Without written feedback in that window the deliverable is accepted; non-blocking issues are handled after acceptance
• Handle any reconfiguration on the source side needed to route data into Cribl Lake or object storage
• Provide an inventory export of existing searches, alerts and dashboards before the planning session
• Provide representative sample data, with no personal data, so engineers can build and test searches offline between sessions
• Content in scope is fixed at the end of the planning stage. An item can be swapped only before work on it has started

Meetings are scheduled at mutually agreed times during VisiCore business hours.

The customer must give at least 48 hours' written notice to cancel, reschedule or shorten a scheduled meeting. Without that notice, VisiCore may count the meeting as delivered.