Cribl Activation
Foundation
Deploy Cribl. Deliver Two Use Cases. Establish a Working System.
What's Included
- Architecture design & dependency planning
- Use Case Planning Workshop
- Cribl deployment (Leader + Worker Groups)
- 2 production-ready use cases
- Source & destination configuration
- Architecture + As-Built documentation
- Knowledge transfer throughout
Why Cribl Deployments Stall
Greenfield Cribl deployments often require rework or fail to reach production when they're not executed inside a structured program.
Architecture decisions are made without dependency planning, leading to rework during deployment and missed integration points.
Pipelines are built without clear use case alignment, resulting in data flows that don't map to business or security outcomes.
Data routing and filtering are inconsistently applied across sources, creating gaps in coverage and unpredictable downstream behavior.
Teams lack the hands-on experience needed to operate the platform after deployment, stalling adoption and increasing dependency on external support.
What We Deliver
A structured activation program delivered in a defined sequence: base scope plus two customer-selected use cases.
Base Activation Scope
- Architecture Design Dependency planning, sizing, and deployment approach tailored to your environment.
- Use Case Planning Workshop Define and prioritize the two use cases to be implemented during the engagement.
- Cribl Deployment Full deployment of Leader and Worker Groups per defined architecture.
- Source & Destination Configuration Connect your data sources and configure destination routing and filtering.
- Deployment Validation End-to-end testing to confirm data flows correctly before production cutover.
- Documentation Architecture doc and As-Built record delivered at engagement close.
Customer-Selected Use Cases
You choose two from the list below. Each is implemented and validated during the activation.
- Data Onboarding: Bring new sources into Cribl and route them to a destination, converting formats to match what the destination expects (up to five sources).
- Advanced Data Onboarding: Onboard sources that need custom REST collectors or advanced configuration (up to two sources).
- Data Archiving: Configure and test archiving beyond Cribl Lake, including S3 partitioning strategy and Log Replay validation.
- Data Reduction: Build pipelines that cut data volume or event size before it reaches your destination (up to five sources).
- Data Routing: Deliver full or filtered data streams to two or more destinations (up to 25 sources).
- Logs to Metrics: Convert event log data into metrics with purpose-built pipelines (up to two sources).
- Edge Deployment: Plan and configure Cribl Edge nodes for data collection (up to three fleets).
- Data Enrichment: Build pipelines that add enrichment context to your data sources (up to three sources).
- Cribl Search: Implement and adopt Cribl Search use cases, with hands-on training against your own data.
- Container Deployment (Enterprise tier only): Deploy Stream in a containerized environment, with container-specific support included.
How We Work Together
Remote, structured, and consultant-led: every session has a defined agenda and a clear output.
~20 Guided Sessions
Structured working sessions with defined agendas. No open-ended calls. Every session moves the deployment forward.
3-Month Window
Delivered over a 3-month activation window, giving your team the time to absorb and validate each phase before moving ahead.
Remote Delivery
Delivered remotely by a Cribl-certified consultant. No travel overhead. Full engagement from day one.
Active Participation Required
This is a collaborative engagement. Your team's involvement is essential: we build alongside you, not for you.
Flexible Purchase Options
Start your activation directly with nth degree, through your preferred VAR or authorized reseller, or via the AWS Marketplace, whichever fits your procurement process.
Fixed Scope
This is a fixed-scope program, not an open-ended deployment. Defined outcomes. Predictable delivery. No scope creep.
What You Walk Away With
Deployed Cribl Environment
Two Production-Ready Use Cases
Validated Data Routing & Filtering
Architecture + As-Built Docs
Knowledge Transfer Throughout
🎯 When to Use This Tier
- Net-new Cribl deployments with no existing infrastructure
- Organizations starting with two defined initial use cases
- Teams that need guided implementation and structured enablement
- Environments where a VAR is managing the client relationship
🏆 What Success Looks Like
- Cribl deployed and operational within 3 months
- Two use cases implemented, tested, and validated in production
- Data flowing correctly to all defined destinations
- Your team is able to operate and extend the platform independently
Foundation Is the Starting Point
Ready to scale? The Strategic and Enterprise tiers build directly on Foundation scope.
Foundation
- Architecture design & dependency planning
- Use Case Planning Workshop
- Cribl deployment (Leader + Worker Groups)
- 2 production-ready use cases
- Source & destination configuration
- Architecture + As-Built documentation
- Knowledge transfer throughout
Strategic
- All Foundation elements
- Up to 3 use cases implemented
- Advanced routing and enrichment
- Custom pipeline development
- Quarterly operational review (2)
Enterprise
- All Strategic elements
- Up to 5 use cases
- Multi-site Edge deployment
- Advanced automation & orchestration
- Ongoing quarterly support
mesh™ Add-On
Optional Enhancement
mesh™This engagement can be enhanced through a mesh™ subscription for ongoing governance, outcome prioritization, and alignment beyond the activation window.
mesh™ keeps your Cribl investment on track after deployment: continuous oversight, not a one-time handoff.
Learn about mesh™ →
A Working System in 3 Months
Cribl Activation Foundation is a structured program, not open-ended deployment. Two validated use cases, production-ready infrastructure, and a team that knows how to run it.