SIEM Migration Essentials

SIEM migrations fail for the same reasons every time: sources that were wired directly into the old platform, detections that quietly depend on vendor-specific fields, and a cutover date that arrives before validation is finished.

VisiCore puts Cribl in front of the SIEM first. Sources are onboarded once, data is shaped to the target schema in the pipeline, and the destination becomes a routing decision. We have run this at global scale, and the same approach makes your next platform change far cheaper than this one.

• Sources onboarded once through Cribl, so the destination can change again later
• Detections validated against the legacy SIEM before cutover
• A documented target architecture your team can extend
• Your highest-value content live on the new SIEM in 90 days

Service

SIEM Migration – Essentials

Part number

VC-PS-SIEM-ESS

Family

SIEM Migration

Platforms

Cribl, SIEM

Engagement

Fixed-scope project, 90 days service period

Pricing

Stated on the Order Form. Request a quote.

SIEM Migration is a fixed-scope consulting engagement that moves your security data and content from an existing SIEM to a new one, with Cribl Stream and Edge as the collection and routing layer. It covers assessment, target design, source onboarding, content porting, validation against the legacy SIEM and cutover.

A dedicated VisiCore engineer, certified on Cribl and experienced with the target SIEM, leads the work alongside your SOC and platform teams. At the end of the engagement your detections are live on the new platform, your sources flow through Cribl, and your team has the documentation to keep extending both.

VisiCore delivers this service remotely through scheduled working sessions led by a named VisiCore engineer who holds current Cribl and/or Splunk certifications. On-site days can be added under a separate order.

Unless agreed otherwise in writing, the engagement starts within one week of VisiCore accepting the signed order. The working schedule is set at the kickoff meeting.

VisiCore provides an agenda before each session, including which of your team members should attend. Sessions run one to four hours.

Every task, decision and deliverable is tracked as a ticket in the X10 client portal, so your team always has a current record of what was done and why.

Scope summary. The base scope below, delivered in approximately 14 working sessions.

• Assessment: inventory of current data sources, ingest volume, detections, saved searches, dashboards, retention and compliance requirements
• Prioritization workshop: must-move, can-retire and rebuild-differently decisions for every piece of content in scope
• Target architecture: Cribl Stream and/or Edge collection tier, worker group and destination design, and a field-normalization plan for the target SIEM schema
• Source onboarding: each in-scope data source routed through Cribl to the target SIEM, with parsing, enrichment and reduction applied in the pipeline
• Content porting: in-scope detections, saved searches and dashboards rebuilt on the target platform and validated against the legacy results
• Cutover plan and execution, including rollback steps
• As-built documentation of the Cribl configuration and the migrated content
• Knowledge transfer in every working session, with recordings where permitted
• A data source is a unique system or platform type (for example Palo Alto firewalls, Windows Event Logs or Linux syslog), not an individual device or protocol.

Quantities

Deliverables

• SIEM footprint inventory and migration priority list
• Target architecture document with the Cribl collection and routing design
• Field-normalization mapping for the target SIEM schema
• In-scope sources flowing through Cribl to the new SIEM in production
• In-scope detections, searches and dashboards live on the new SIEM with validation evidence
• Cutover plan, rollback plan and post-cutover report
• Session recordings and knowledge-transfer notes in the X10 portal

VisiCore Technology Group provides the services described in this brief under the applicable Order Form and the VisiCore Master Services Agreement, or another written agreement in place between VisiCore and the customer.

Session and hour counts in this brief are planning estimates for the work described, not a guarantee of a fixed number of service hours.

Pricing is stated on the Order Form. Contact VisiCore for a quote.

The following are not included unless added to the Order Form:

• Installation, modification or maintenance of customer hardware, operating systems, containers, firewalls or load balancers
• Changes to the configuration of source or destination systems outside the platform in scope
• Backup and recovery, or day-to-day maintenance, of the customer's environment
• Performance testing and benchmarking
• Formal product training beyond the guidance given in working sessions
• Any service or activity not explicitly listed in the Scope section of this brief
• Licensing or subscription of the target SIEM
• Building net-new detections beyond porting the existing ones in scope (see Content Factory or Resident Engineer)
• Historical data backfill into the new SIEM
• Decommissioning the legacy SIEM, including its licence, hardware or data export
• Custom collectors for systems that have no native Cribl or SIEM integration (see Content Factory: Custom Pack)
• A parallel-run period with both SIEMs receiving the in-scope sources (included in the Advanced and Enterprise tiers)

90 days.

• The customer has 90 days from the start date (the "Service Period") to schedule and use the services in this brief.
• The service ends automatically at the close of the Service Period unless VisiCore agrees in writing to extend it.
• Unused portions of the service are non-refundable and non-creditable.
• VisiCore may deliver services after the Service Period if the customer gives written notice at least 30 days before it ends and VisiCore agrees.

To deliver this service on schedule, the customer agrees to:

• Name an engagement lead with the authority to make decisions and accept deliverables
• Provide the accounts, access and network connectivity VisiCore engineers need before the first working session
• Attend scheduled sessions (one to four hours each) and complete prerequisite work before them
• Bring the subject-matter experts who own the systems being integrated
• Review each deliverable within five business days of hand-off. Without written feedback in that window the deliverable is accepted; non-blocking issues are handled after acceptance
• Export the existing detections, saved searches and dashboards from the current SIEM before the assessment sessions
• Have the target SIEM tenant provisioned, licensed and reachable, with administrative access for VisiCore engineers
• Name an owner on the SOC side who validates each migrated detection and signs off on the validation results before cutover
• Provide representative sample data, with no personal data, so engineers can build pipelines and normalization offline between sessions
• Content in scope is fixed at the prioritization workshop. An item can be swapped only before work on it has started

Meetings are scheduled at mutually agreed times during VisiCore business hours.

The customer must give at least 48 hours' written notice to cancel, reschedule or shorten a scheduled meeting. Without that notice, VisiCore may count the meeting as delivered.