Try our new research platform with insights from 80,000+ expert users

Cribl vs Panther comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cribl
Ranking in Security Information and Event Management (SIEM)
10th
Average Rating
8.6
Reviews Sentiment
6.7
Number of Reviews
25
Ranking in other categories
Application Performance Monitoring (APM) and Observability (12th), Log Management (6th), Observability Pipeline Software (1st)
Panther
Ranking in Security Information and Event Management (SIEM)
45th
Average Rating
8.0
Reviews Sentiment
7.3
Number of Reviews
1
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of November 2025, in the Security Information and Event Management (SIEM) category, the mindshare of Cribl is 1.2%, up from 0.3% compared to the previous year. The mindshare of Panther is 0.4%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM) Market Share Distribution
ProductMarket Share (%)
Cribl1.2%
Panther0.4%
Other98.4%
Security Information and Event Management (SIEM)
 

Featured Reviews

Richard McIver - PeerSpot reviewer
Simplifies data processing and reduces ingest costs through real-time transformation
My favorite feature of Cribl is just how easy it makes working with the data; it's always been a pain point for us with other solutions, just taking our raw data from the source, transforming and manipulating it into what we need on the SIM side. That's always been a pretty heavy lift, however, Cribl has made that much easier. The tools built into the platform allow us to work with the data, see the results in real-time, see what the output's going to look before we commit it, and has really made our job in that respect a lot easier. The Cribl UI is very simple and easy to use, particularly when working with data from various sources; it makes it very easy to create pipelines, add complex logic to those pipelines, and then gives you a preview of what your data looks like before applying that pipeline and what you get after. As we're bringing data in and Cribl's processing it, it makes it very easy to identify subsets of data or certain events that source data that maybe are less useful or just noisy, not really applicable to to what we need what our security team needs, and we're able to just drop those events before they get sent out and and ingested by our SIEM. So that helps keep our data pipeline streamlined, keeps our output clean. It filters out noise, and then it makes our analysis more efficient. That reduces the data volume going into our SIMs, and that reduces and limits the ingest costs associated with that end. With less data, there's less to process when you're running complex searches. So we have charges against those compute resources reduced.
RT
Detection capabilities and helpful support team enhance log analysis and integration flexibility
I find Panther's detection capabilities and integrations to be highly valuable. It allows integration with anything as long as I am willing to write detections, and their team is very helpful. I find its log analysis capabilities valuable. It enables me to filter down to individual roles in AWS, and if I am skilled at SQL queries, I can query anything. The infrastructure as code feature allows me to use Git repositories to manage detections and import detections from other Git repositories.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I'd rate the solution ten out of ten."
"The product's most valuable features include the internal management of events, coding perspective, data processing, and serialization."
"We reduce cost by using Cribl to control what data we need to be sent over to the SIEM, and we were able to use their functionality, specifically aggregation and also some of the drop functions within Cribl to cut down this noise, send a full copy of the data to S3 or a different data lake, and then send the reduced log over to the SIEM."
"Cribl definitely helps with the complexity because you don't have to push for deployment—they provide the interface where you can mimic what the output will look like, and you can see that in real time when setting up the Cribl configuration, which definitely helps considerably."
"The Stream product benefits us as it gives us the ability to reduce and streamline the logs that we have getting into our SIEM."
"The features of Cribl that I appreciate the most are the ability for in-place searching for our logs, so we don't have to move our logs outside of our cloud, which gives us privacy and compliance requirements."
"Our experience with Cribl has been very smooth; everything runs seamlessly, there are no delays or sluggishness, which I really appreciate."
"What I appreciate the most about Cribl is the free training, the free access to all the training, and how easy it is to learn it."
"I find Panther's detection capabilities and integrations to be highly valuable."
 

Cons

"Cribl doesn't have as many packs available"
"Improvement could be made in the logging area, as sometimes we encounter issues in a pipeline or something, and it's not immediately obvious when you look at the logs that the pipeline is failing."
"There is room for improvement in the documentation and knowledge base, particularly regarding configurations like sources where logs are being ingested"
"Optimizing CPU utilization on the edge side is something that could be improved; we see, particularly on older hardware and older OSes, Cribl Edge service can eat up quite a bit of CPU resources compared to some other products we've used in the past, indicating there's room for improvement."
"Cribl could be improved by some UI tweaks and some usability tweaks, mostly centered around error troubleshooting for large volumes of Edge nodes."
"Currently, Cribl Search is dedicated to one bucket at a time in the case of S3 buckets. The ability to search for multiple buckets would be awesome."
"There have been several administrative issues. Another point is that the browsing functions aren't very intuitive."
"Improvement could be made in the logging area, as sometimes we encounter issues in a pipeline or something, and it's not immediately obvious when you look at the logs that the pipeline is failing."
"The solution could be improved by providing more built-in integrations, which would reduce the need for me to build them myself."
 

Pricing and Cost Advice

"The product pricing is reasonable compared to other solutions."
"I would not say it is a cheaply priced tool as it has been doing wonders in the market. The tool has been budget-friendly for organizations."
Information not available
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
872,837 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
16%
Computer Software Company
8%
Manufacturing Company
8%
Healthcare Company
7%
Manufacturing Company
17%
Computer Software Company
15%
University
11%
Financial Services Firm
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business9
Midsize Enterprise5
Large Enterprise15
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Cribl?
I did not deal with pricing directly. We had a team that dealt with Cribl.
What needs improvement with Cribl?
The product is very good. They could add more AI-assisted pipeline development in the future release.
What is your primary use case for Cribl?
My current use cases involve using it as a pipeline to process data, to route data from cloud logs to different repositories. Some data goes to Splunk and others go to different data lakes. I didn'...
What is your experience regarding pricing and costs for Panther?
I find the pricing to be reasonable, although I can't recall the exact cost.
What needs improvement with Panther?
The solution could be improved by providing more built-in integrations, which would reduce the need for me to build them myself.
What is your primary use case for Panther?
We use Panther ( /products/panther-reviews ) for our SIEM ( /categories/security-information-and-event-management-siem ) solution. It is used for aggregating logs and analyzing user activities. We ...
 

Comparisons

 

Overview

 

Sample Customers

Information Not Available
Docker, Loom, Discord, Dropbox, HubSpot, Asana, GoFundMe, Zapier, Benchling, JupiterOne, Jumio, Bitstamp, Intercom, Randori, and Cedar
Find out what your peers are saying about Splunk, Wazuh, Microsoft and others in Security Information and Event Management (SIEM). Updated: October 2025.
872,837 professionals have used our research since 2012.