My favorite feature of Cribl is just how easy it makes working with the data; it's always been a pain point for us with other solutions, just taking our raw data from the source, transforming and manipulating it into what we need on the SIM side. That's always been a pretty heavy lift, however, Cribl has made that much easier. The tools built into the platform allow us to work with the data, see the results in real-time, see what the output's going to look before we commit it, and has really made our job in that respect a lot easier. The Cribl UI is very simple and easy to use, particularly when working with data from various sources; it makes it very easy to create pipelines, add complex logic to those pipelines, and then gives you a preview of what your data looks like before applying that pipeline and what you get after. As we're bringing data in and Cribl's processing it, it makes it very easy to identify subsets of data or certain events that source data that maybe are less useful or just noisy, not really applicable to to what we need what our security team needs, and we're able to just drop those events before they get sent out and and ingested by our SIEM. So that helps keep our data pipeline streamlined, keeps our output clean. It filters out noise, and then it makes our analysis more efficient. That reduces the data volume going into our SIMs, and that reduces and limits the ingest costs associated with that end. With less data, there's less to process when you're running complex searches. So we have charges against those compute resources reduced.
