Managed Solutions

Splunk and Cribl are the plumbing under your security and observability programs. When they are healthy nobody notices; when they are not, detections go quiet, dashboards lie and the bill climbs. Running them well is steady, specialized work that is hard to staff and easy to defer.

Managed Solutions hands that work to VisiCore. A named service manager owns the relationship, an engineering rotation covers the day to day, and every change, incident and review lands in the X10 client portal where your team can see it.

• Immediate time to value: VisiCore takes operational ownership from day one
• Defined business-hours response targets for P1 and P2 incidents
• Upgrades, patching and FinOps reviews happen on a schedule, not when someone remembers
• A named service manager, an engineering rotation and every change recorded in the X10 portal

Service

Managed Solutions

Part number

VC-MS-MANAGED

Platforms

Cribl, Splunk

Engagement

Ongoing subscription, 12-month term

Pricing

Stated on the Order Form. Request a quote.

Managed Solutions is a 12-month service in which VisiCore operates your Cribl and Splunk estate. It covers monitoring and health, incident response during business hours, upgrades and patching in agreed windows, monthly FinOps and license reviews, change management through portal tickets, an onboarding backlog for new sources, and a quarterly architecture and roadmap review.

The environments covered and the monthly hands-on allotment are sized at scoping and stated on the Order Form. A named VisiCore service manager is your single point of contact; an engineering rotation with current Cribl and Splunk certifications does the work.

VisiCore delivers this service remotely through a named service manager and a rotation of Cribl and Splunk certified engineers: monitoring and incident response during business hours, ticket-driven changes, and scheduled monthly and quarterly reviews. On-site days can be added under a separate order.

Unless agreed otherwise in writing, the engagement starts within one week of VisiCore accepting the signed order. The working schedule is set at the kickoff meeting.

VisiCore provides an agenda before each session, including which of your team members should attend. Sessions run one to four hours.

Every task, decision and deliverable is tracked as a ticket in the X10 client portal, so your team always has a current record of what was done and why.

• Monitoring and health of the in-scope Cribl and Splunk environments using CriblVision, the Splunk Monitoring Console and VisiCore's health checks
• Incident response during business hours against the P1 and P2 targets below, with root-cause notes for P1 incidents
• Upgrades and patching for Cribl and Splunk components on a quarterly cadence, in agreed maintenance windows, with pre-checks, validation and rollback planning
• Monthly FinOps and license review: ingest trends, license headroom, Cribl credit consumption, storage tiering and reduction opportunities
• Change management: changes requested, approved, executed and recorded through X10 portal tickets
• Onboarding backlog: new sources, routes and routine content requests prioritized with your named owner and worked within the monthly allotment
• Quarterly architecture and roadmap review with your service manager
• Named service manager plus an engineering rotation; monthly service report covering incidents, changes, hours and recommendations

Quantities

Deliverables

• Onboarding: environment inventory, monitoring configured, access and change windows confirmed, runbook baseline
• Incident tickets with resolution and, for P1, root-cause notes
• Change tickets with approval, execution record and validation
• Upgrade plans and completion reports each quarter
• Monthly service report: incidents, changes, hours used, FinOps findings and recommendations
• Quarterly architecture and roadmap review document

VisiCore Technology Group provides the services described in this brief under the applicable Order Form and the VisiCore Master Services Agreement, or another written agreement in place between VisiCore and the customer.

The monthly allotment stated on the Order Form is the committed amount of VisiCore engineer time for each month of the term. Time is drawn against tickets and scheduled sessions and tracked in the X10 client portal.

Pricing is stated on the Order Form. Contact VisiCore for a quote.

The following are not included unless added to the Order Form:

• Installation, modification or maintenance of customer hardware, operating systems, containers, firewalls or load balancers
• Changes to the configuration of source or destination systems outside the platform in scope
• Performance testing and benchmarking
• Formal product training courses beyond the guidance given in sessions and tickets
• Products other than Cribl and Splunk, except where they are a configured source or destination of the in-scope platforms
• After-hours and 24×7 coverage unless the after-hours add-on is purchased
• Net-new project delivery: new deployments, migrations and custom content belong in the Activation, Migration and Content Factory engagements
• An end-user Splunk search help desk
• Hands-on work beyond the monthly allotment set at scoping
• Any service or activity not described in the Scope section of this brief

12 months.

• The term is 12 months from the start date, renewable by mutual agreement.
• Monthly allotments reset on the first of each month. Unused time carries over for one month and is otherwise forfeited; carried-over time is used before the current month's allotment.
• Either party may end the term for convenience with 60 days' written notice. Pre-paid, unused months are refunded; the current month is not.
• The monthly hands-on allotment and the environments covered are set at scoping and stated on the Order Form. Work beyond the allotment is agreed in advance and billed as additional credits.

To deliver this service on schedule, the customer agrees to:

• Name an engagement lead with the authority to make decisions and accept deliverables
• Provide the accounts, access and network connectivity VisiCore engineers need before the first working session
• Attend scheduled sessions (one to four hours each) and complete prerequisite work before them
• Bring the subject-matter experts who own the systems being integrated
• Provide administrative access to the in-scope environments through named VisiCore service accounts
• Agree maintenance windows for upgrades and standing change windows for routine changes
• Name an owner who approves changes, prioritizes the onboarding backlog and attends the monthly and quarterly reviews
• Provide read access to cloud and vendor billing so the FinOps review reflects what you actually pay
• Raise requests and report incidents through the X10 client portal so response targets and history are tracked

Meetings are scheduled at mutually agreed times during VisiCore business hours.

The customer must give at least 48 hours' written notice to cancel, reschedule or shorten a scheduled meeting. Without that notice, VisiCore may count the meeting as delivered.