SIEM Migration Advanced

SIEM migrations fail for the same reasons every time: sources that were wired directly into the old platform, detections that quietly depend on vendor-specific fields, and a cutover date that arrives before validation is finished.

VisiCore puts Cribl in front of the SIEM first. Sources are onboarded once, data is shaped to the target schema in the pipeline, and the destination becomes a routing decision. We have run this at global scale, and the same approach makes your next platform change far cheaper than this one.

• Sources onboarded once through Cribl, so the destination can change again later
• Two weeks of side-by-side validation before you switch off the old SIEM
• Full-fidelity archive in object storage, so the new SIEM only indexes what it needs
• Seventy-five detections and fifteen dashboards live on the new SIEM

Service

SIEM Migration – Advanced

Part number

VC-PS-SIEM-ADV

Family

SIEM Migration

Platforms

Cribl, SIEM

Engagement

Fixed-scope project, 120 days service period

Pricing

Stated on the Order Form. Request a quote.

SIEM Migration is a fixed-scope consulting engagement that moves your security data and content from an existing SIEM to a new one, with Cribl Stream and Edge as the collection and routing layer. It covers assessment, target design, source onboarding, content porting, a parallel-run period and cutover.

A dedicated VisiCore engineer, certified on Cribl and experienced with the target SIEM, leads the work alongside your SOC and platform teams. At the end of the engagement your detections are live on the new platform, your sources flow through Cribl, and your team has the documentation to keep extending both.

VisiCore delivers this service remotely through scheduled working sessions led by a named VisiCore engineer who holds current Cribl and/or Splunk certifications. On-site days can be added under a separate order.

Unless agreed otherwise in writing, the engagement starts within one week of VisiCore accepting the signed order. The working schedule is set at the kickoff meeting.

VisiCore provides an agenda before each session, including which of your team members should attend. Sessions run one to four hours.

Every task, decision and deliverable is tracked as a ticket in the X10 client portal, so your team always has a current record of what was done and why.

Scope summary. The base scope below, delivered in approximately 26 working sessions.

• Assessment: inventory of current data sources, ingest volume, detections, saved searches, dashboards, retention and compliance requirements
• Prioritization workshop: must-move, can-retire and rebuild-differently decisions for every piece of content in scope
• Target architecture: Cribl Stream and/or Edge collection tier, worker group and destination design, and a field-normalization plan for the target SIEM schema
• Source onboarding: each in-scope data source routed through Cribl to the target SIEM, with parsing, enrichment and reduction applied in the pipeline
• Content porting: in-scope detections, saved searches and dashboards rebuilt on the target platform and validated against the legacy results
• Cutover plan and execution, including rollback steps
• As-built documentation of the Cribl configuration and the migrated content
• Knowledge transfer in every working session, with recordings where permitted
• A data source is a unique system or platform type (for example Palo Alto firewalls, Windows Event Logs or Linux syslog), not an individual device or protocol.
• Parallel run: both SIEMs receive the in-scope sources for two weeks while detection results are compared and tuned
• Archive destination: a full-fidelity copy of in-scope sources routed to customer-owned object storage with replay configured

Quantities

Deliverables

• SIEM footprint inventory and migration priority list
• Target architecture document with the Cribl collection and routing design
• Field-normalization mapping for the target SIEM schema
• In-scope sources flowing through Cribl to the new SIEM in production
• In-scope detections, searches and dashboards live on the new SIEM with validation evidence
• Cutover plan, rollback plan and post-cutover report
• Session recordings and knowledge-transfer notes in the X10 portal

VisiCore Technology Group provides the services described in this brief under the applicable Order Form and the VisiCore Master Services Agreement, or another written agreement in place between VisiCore and the customer.

Session and hour counts in this brief are planning estimates for the work described, not a guarantee of a fixed number of service hours.

Pricing is stated on the Order Form. Contact VisiCore for a quote.

The following are not included unless added to the Order Form:

• Installation, modification or maintenance of customer hardware, operating systems, containers, firewalls or load balancers
• Changes to the configuration of source or destination systems outside the platform in scope
• Backup and recovery, or day-to-day maintenance, of the customer's environment
• Performance testing and benchmarking
• Formal product training beyond the guidance given in working sessions
• Any service or activity not explicitly listed in the Scope section of this brief
• Licensing or subscription of the target SIEM
• Building net-new detections beyond porting the existing ones in scope (see Content Factory or Resident Engineer)
• Historical data backfill into the new SIEM beyond the parallel-run window
• Decommissioning the legacy SIEM, including its licence, hardware or data export
• Custom collectors for systems that have no native Cribl or SIEM integration (see Content Factory: Custom Pack)

120 days.

• The customer has 120 days from the start date (the "Service Period") to schedule and use the services in this brief.
• The service ends automatically at the close of the Service Period unless VisiCore agrees in writing to extend it.
• Unused portions of the service are non-refundable and non-creditable.
• VisiCore may deliver services after the Service Period if the customer gives written notice at least 30 days before it ends and VisiCore agrees.

To deliver this service on schedule, the customer agrees to:

• Name an engagement lead with the authority to make decisions and accept deliverables
• Provide the accounts, access and network connectivity VisiCore engineers need before the first working session
• Attend scheduled sessions (one to four hours each) and complete prerequisite work before them
• Bring the subject-matter experts who own the systems being integrated
• Review each deliverable within five business days of hand-off. Without written feedback in that window the deliverable is accepted; non-blocking issues are handled after acceptance
• Export the existing detections, saved searches and dashboards from the current SIEM before the assessment sessions
• Have the target SIEM tenant provisioned, licensed and reachable, with administrative access for VisiCore engineers
• Name an owner on the SOC side who validates each migrated detection and signs off on parallel-run results
• Provide representative sample data, with no personal data, so engineers can build pipelines and normalization offline between sessions
• Content in scope is fixed at the prioritization workshop. An item can be swapped only before work on it has started
• Provide an object storage bucket (S3, Azure Blob or GCS) with write credentials before the destination configuration sessions

Meetings are scheduled at mutually agreed times during VisiCore business hours.

The customer must give at least 48 hours' written notice to cancel, reschedule or shorten a scheduled meeting. Without that notice, VisiCore may count the meeting as delivered.