Join Cribl’s co-founders and executive leaders for a look at how Cribl, the AI Platform for Telemetry, is helping Security and IT teams unlock the full value of their data in the AI era. Built on an AI-first architecture, Cribl gives teams the choice, control, and flexibility to build the apps and workflows they need for both human analysts and AI agents.

Expect big-picture vision, product innovation, live demos, and a glimpse at how Cribl is shaping what’s next as an open, flexible, and future-proof platform for telemetry. Consider this your first glimpse at the practical spellbook for the AI-ready future.

This is where the future of Agentic Telemetry starts to take shape — and where a little Magic in the Making becomes what’s next.

Join us for a candid conversation with Cribl customers about what it really takes to move from AI vision to practical action. This session will explore the trade-offs, challenges, and progress teams are making as they navigate AI adoption, telemetry strategy, and the path from where they are today to what’s next.

Show off your data skills and come play in our Jeopardy / Capture the Flag style game. It’s your first day as the newest hire at Cribl Coffee Company on the Data for IT and Security (DITS) team. You’re a Cribl pro, and it’s time to prove it.

You and your teammate will race against the clock to close as many tickets as possible, debug frustrating “coffee-stained” puzzles, and out-caffeinate, out-hack, and out-goat the competition. We’ve got prizes, plenty of laughs, and a chance to sharpen your Cribl skills along the way.

Bring your app, your idea, or just your laptop and agent.

This is dedicated time to build on the Cribl AI platform with Cribl PMs, community members, and the people who know the product best in the same room. If you've been working on something and need to get it across the finish line, this is your moment. If you've been curious about building and haven't started yet, there's no better place to take your first shot at it.

Best apps submitted will be judged at the end of the day and awarded prizes. Fame and fortune can be YOURS!

In this moderated Q&A, a SVP of Cybersecurity - Security Engineering & Data Protection and a Vice President of Enterprise Technology Tooling will discuss how an urgent logging challenge evolved into a broader, multi-year telemetry modernization effort inside a large, regulated enterprise.

The session will highlight not only the technical evolution, but also the partnership that made it possible — how a line-of-business team and a centralized platform owner built trust, aligned on ownership, and expanded the strategy without disrupting the teams closest to the work.

Whether it is a security alert or a performance degradation, your team is tasked with interpreting fragmented telemetry to uncover the truth under extreme pressure. Investigations are time-consuming and depend on specialized expertise, which is why modern AI solutions for security and IT operations focus heavily on this core capability. From AI SOC to autonomous SRE, the fundamental value lies in an agent's ability to conduct an effective investigation.

But with new AI models launching constantly, security and IT teams face a practical challenge: how do you know which models are actually best for your investigations?

Traditional AI benchmarks can tell you how well a model codes or handles general reasoning, but not how it will perform when investigating a security incident, troubleshooting an outage, or working with messy, incomplete telemetry. And as teams gain more flexibility to bring their own models and token economics become increasingly important, choosing the right model for the right job matters more than ever.

In this session, we’ll introduce SecIT Bench, Cribl’s benchmark for evaluating AI across real-world security and IT scenarios, and show how its findings can help you make smarter AI decisions.

You’ll learn how to:

• Compare models across accuracy, cost, speed, and efficiency
• See where different models excel or struggle across security and observability workflows
• Understand how the tooling around a model impacts its performance
• Make better model choices based on your workflows, priorities, and budget

You’ll leave with a practical framework for looking beyond headline benchmark scores and making more informed decisions about the AI powering your security and IT workflows.

Speakers:

• Connor Swanson, Staff Research Engineer, Cribl
• Sasikanth Vadlamudi, Staff Product Manager, Cribl

AI has collapsed the IOC decay curve to zero — hash values die in one model inference, domains in a single campaign. The bottom of the Pyramid of Pain isn't eroding, it's on fire, and more threat feeds won't fix it.

Drawing on a 12-month dataset of 832 AI-assisted threat actors — including GTG-1002, the highest-risk actor observed — this session introduces APEX: a signal-based detection framework that chains behavior, not techniques, into 23 named detections and turns alerts into analyst-ready briefs in under 90 seconds.

You'll learn:

• Why static IOC- and rule-based detection can't keep pace with AI-assisted adversaries
• How to architect a source-agnostic detection pipeline that survives vendor schema changes
• What 23 production behavioral chains look like, tiered by empirical risk score

Speaker:

• Nicole Beckwith, Sr. Director, Security Engineering & Operations, Cribl

AI-assisted development has collapsed the time from idea to working app from weeks to minutes — but the platforms your team depends on still take weeks to ship a feature, and for good reason. Reliability at scale demands rigor. So how do you give your teams AI-speed iteration without sacrificing the stability you've built your critical workflows on?

This session goes inside the architectural decisions behind building apps on Cribl’s platform: how we separated AI velocity from platform stability using a strict trust boundary, sandboxed execution, and a controlled set of managed backend primitives (state, webhooks, secure proxies). We'll cover what we chose to build, what we deliberately deferred, and how the same model applies to any platform facing the AI-speed shift.

You'll leave with:

• A framework for thinking about the trade-off between customization velocity and platform rigor
• The three architectural principles that make AI-assisted extensibility safe: trust boundaries, sandboxed execution, and managed backend primitives
• Guidance on when to build a custom app, when to extend with a pack, and when to push for first-party capability

Intended for architects, platform engineers, and technical leaders thinking about application building in the AI era.

Speakers:

• Glenn Block, Sr Group Product Manager, Cribl
• Nick Romito, Software Architect, Cribl

What starts as a focused security implementation can become the foundation for a much broader telemetry strategy. In this session, the StoneX team shares how we evolved our Cribl journey from solving immediate security challenges into a scalable, enterprise-wide platform engineering capability. We will detail the architectural shifts that enabled us to move beyond centralized collection toward true data governance, enabling us to support both legacy security tools and emerging, high-scale AI workflows.

We will share our experience managing organizational handoffs and provide an honest look at our current proof-of-concept work involving AI prompt and response data and OpenTelemetry logs. Attendees will leave with practical ideas for scaling a successful use case into a broader enterprise-wide solution, navigating organizational handoffs, and building a telemetry foundation that can adapt as tools, teams, and AI-driven workflows evolve.

Speakers:

• Blake Nisius, Manager, Threat Detection & Applied Intelligence, StoneX Group
• Frank McGovern, Chief Information Security Officer, StoneX Group

The enterprise world is currently caught in a "moment of paralysis" regarding Artificial Intelligence. While the potential for transformation is undeniable, large organizations often find themselves stalled by complex regulations, data security concerns, and the sheer pace of model evolution. Join Kyle Obear, enGen, and Nikhil Mungel, Cribl, to cut through the hype and explore how to start using AI responsibly in modern observability technical operations.

This session will discuss the necessity of establishing data control points to manage the transition to AI-assisted workflows responsibly. This includes addressing concerns around model drift, quality assurance, and the "Bring Your Own Model" (BYOM) trend. By implementing these controls, organizations can ensure that as they move toward agentic workflows, their telemetry and token usage remain visible, secure, and aligned with operational goals.

Attendees will leave this session understanding:

• How AI bridges the expertise gap by abstracting complex operational skills into reusable components and streamlined workflows.
• Strategies for responsible AI experimentation within highly regulated sectors, focusing on risk reduction and secure access patterns.
• How to implement control points to monitor telemetry, token usage, and model quality while supporting diverse model ecosystems.
• How to move from paralysis to scalable, AI-assisted observability with actionable design patterns.

Whether you are starting your journey or scaling existing efforts, this session offers a framework for building responsibly in a domain where data context and system behavior matter most.

Speakers:

• Kyle Obear, Senior Technical Engineer, enGen
• Nikhil Mungel, Head of AI R&D, Cribl

Observability is broken when logs, metrics, and traces are siloed across disparate tools causing fragmented visibility, forcing SREs into a 'swivel chair' existence that stalls root cause analysis (RCA). Worse, without unified context, AI tools struggle to provide actionable insights.

In this session, this Leading Global Media and Entertainment Company shares how they transformed their observability strategy using Cribl Stream. You’ll learn how to unify disparate data by enriching tags, converting logs to metrics and OpenTelemetry Protocol (OTLP), and bifurcating data to existing APM and logging solutions. See how this unified approach empowers AI-driven RCA and provides SREs with the centralized visibility required to validate and remediate issues in minutes.

Attendees will learn how to:

• Enrich, tag, and convert disparate logs into metrics and OpenTelemetry (OTLP) traces to create a unified, usable data stream.
• Implement data bifurcation to feed existing APM and logging solutions simultaneously, eliminating the 'swivel chair' workflow for SREs.
• Enable AI systems to perform accurate root cause analysis by providing full, correlated data context.
• Accelerate troubleshooting workflows to validate and remediate issues in minutes rather than hours.

Speakers:

• Vivek Gurikar, Staff Platform Engineer, Global Media and Entertainment Company
• Himanshu Sharma, Senior Platform Engineer, Global Media and Entertainment Company

Modern enterprise infrastructure complexity often creates a bottleneck for L1 and L2 support teams, leading to delayed incident resolution and the constant struggle of managing disparate access privileges. In this session, discover how to leverage the combination of AI agents and Cribl’s Telemetry Platform  to deliver fully automated, secure incident triage at scale. We will walk through the architecture of a unified search strategy, from partitioning data via Cribl Stream to AI-driven investigation, that allows agents to trace issues across cloud environments, datacenters, divergent network segments, and proxies without the need for manual high-privilege access. Join us to learn how to transform complex RCA processes into a streamlined, automated workflow that slashes MTTR from hours to minutes.

Attendees will:

• Learn how to partition application and platform logs into a single search-head using Cribl, creating a simplified, secure integration point for AI-driven observability.
• Explore the practical workflow for enabling agents to navigate complex, multi-segment cloud to on-prem infrastructure, pinpointing root causes instantly.
• Understand how to eliminate the reliance on manual triage meetings and sensitive access recertification, drastically improving SLAs and reducing Mean Time to Resolution (MTTR) by orders of magnitude.

Speakers:

• Nick Coury, VP Cloud Security & SRE, Prudential
• Emilio Garcia, Lead Software Engineer, Prudential

As the organization’s cloud footprint grew, so did the complexity of its telemetry program: inconsistent VPC flow log formats, manual account-by-account setup, compliance gaps, and rising data costs all made it difficult to scale efficiently. In this session, a Global Hospitality Company will share how it matured its centralized logging service with AWS Control Tower to enforce standards, Cribl to centralize and optimize data delivery, and S3 as the storage layer to decouple retention from analysis.

The result was a more auditable, scalable telemetry pipeline that reduced VPC flow log volume by 38%, lowered costs, and made the organization’s data more flexible for future use cases — including AI-ready analytics and whatever tool comes next. This session will walk through the operational and architectural changes that helped move from manual processes to a scalable data strategy built for compliance, efficiency, and reuse.

Attendees will learn:

• Why setting telemetry standards, and a happy path to follow them, is critical at cloud scale
• How to reduce ingest volume and cost while preserving the data that matters
• Why separating storage from analysis creates a more flexible, reusable telemetry foundation
• How to frame telemetry modernization in terms of measurable operational and business value

Facing double-digit annual increases in logging costs, Velera broke free from vendor lock-in by shifting from a "rip and replace" strategy to a data pipeline-first approach. By implementing a tiered architecture for collection, transformation, and unified analytics, Velera achieved over $1M in measurable ROI.

In this session, you’ll learn how Velera:

• Cut cloud-based logging OpEx by $500K and freed 100TB of storage.
• Reduced daily log ingestion by 60% using intelligent filtering and deduplication.
• Integrated new tools—including APM and lakehouse engines—without breaking existing infrastructure.
• How a "Cribl-first" mindset turns persistent data challenges into predictable, repeatable success.
• Discover how to stop fighting your tools and start mastering your data strategy.

Speakers:

• Earl Diem, Vice President, Operations Engineering, Velera
• Dhevasenapathy R S, Manager, Monitoring & Logging, IT Operations Engineering, Velera

Security investigations span dozens of data sources — SIEM, network flows, identity logs, cloud audit trails — and analysts spend more time switching tools than investigating. Cribl's Federated Search solves the data access problem by querying across dispersed sources without centralizing everything. Strands Agents, connected through Amazon Bedrock AgentCore Gateway, add the intelligence layer: an agent that knows what to ask, where to look, and how to correlate findings into a coherent investigation.

In this session, we dive deep into the architecture pattern — how a Strands agent invokes Cribl Federated Search as an MCP tool through AgentCore Gateway, driving autonomous cross-source investigations from alert to conclusion. When an alert fires, the agent federates queries across your existing data stores through governed tool calls, follows the evidence trail, and surfaces correlated findings — without an analyst manually pivoting between consoles.

We'll dive deep into:

• Strands agent architecture — how the open-source SDK's native MCP client connects to AgentCore Gateway, giving the agent access to Cribl Federated Search as a callable tool with zero custom integration code
• AgentCore Gateway as the MCP bridge — Cribl's existing search API registered as an MCP target with a tool schema defining search inputs/outputs
• How the agent reasons about which data sources to query and how to chain findings across Security Lake, S3, and third-party stores — with full control over the orchestration loop (custom reasoning, retries, evidence chaining)
• Governed tool access — Gateway-managed credential vending, identity propagation, and per-session authorization so agents query only what they're scoped to see
• Building investigation workflows that traverse dispersed log stores, identity systems, and telemetry in real time
• Observability and audit trails — Gateway-emitted traces per tool invocation plus Strands' built-in agent tracing, maintaining compliance and analyst trust through full explainability of the agent's reasoning chain.

Attendees will leave with an understanding of how Cribl leverages Strands Agents and Amazon Bedrock AgentCore to solve real-world customer challenges in security investigations — reducing complexity, accelerating time to resolution, and meeting data analysts where their data already lives.

Speakers:

• Aswin Vasudevan, Sr Solutions Architect, Amazon Web Services
• Gabriel Costa, Sr Partner Solutions Architect, Amazon Web Services

AI promises to transform security operations, but what does that actually look like day-to-day? In this session, Cribl's own security team pulls back the curtain on how they use Cribl Search’s AI-powered investigation feature to hunt for threats, investigate anomalies, and quickly respond to incidents across their environment. Expect real workflows, honest lessons learned, and concrete examples of threats that AI helped surface that traditional approaches missed. Whether you're evaluating the new tool or already using it, you'll walk away with practical tips and tricks that can help you get to the bottom of incidents faster.

Attendees will learn:

• How Cribl's security team structures AI-assisted threat hunting, including query and prompt strategies that actually work
• Real examples of threats and anomalies surfaced using Cribl’s investigative tools
• Where AI accelerates workflows and where a human still needs to lead
• How data quality in your Cribl pipelines directly affects AI output

Speaker:

• Alexandria Crusco, Staff Security Engineer, Cribl
• Nicole Beckwith, Sr. Director, Security Engineering and Operations, Cribl

Zoom Communications operates across data centers and public clouds at massive scales. To support secure, vendor-neutral log collection and future-proof security operations, the team standardized on Cribl Edge. In this session, attendees will learn the architectural decisions, configuration patterns, and AI-assisted automation techniques that made large-scale Cribl Edge deployment practical.

Speakers:

• George Navarrete, Sr. Manager Security DataOps, Zoom Communications
• Iman Roodbaei, Principal Security Infra & Data Architect, Zoom Communications
• Luan Tran, Senior Product Security Engineer, Zoom Communications

Your data is everywhere — hot storage, cold storage, across silos — and your investigation tools were never built for that reality. Costs keep climbing, historical data stays out of reach, and analysts waste time chasing down context that should already be at their fingertips.

This session is a full showcase of what Cribl Search and Cribl Lake can do together. We’ll walk through the federated and lakehouse engines, how Cribl Lake provides a cost-effective home for high-volume telemetry without sacrificing queryability, and how teams can access and analyze data across environments from a single search experience. 

We'll also dig into one of the biggest shifts this combination enables: a genuine path away from SIEM dependency. Store your data where you want, search it instantly, and gradually evolve toward a more flexible architecture — without losing visibility at any step.

You'll leave with:

• A clear picture of what Cribl Search and Lake can do together across federated and lakehouse engines
• Practical use cases for faster, more cost-effective investigations
• Strategies for reducing SIEM reliance without sacrificing visibility
• A look at what's new and what's coming

For analysts, detection engineers, and security architects looking to modernize how their teams find and act on data.

Speakers:

• Dan Marantz, Sr. Director Product Management, Cribl
• Rick Salsa, Sr. Staff Product Manager, Cribl

Previously, during South Australia Power Networks’ incident response live-fire exercise (based on real-world incidents), we found that tool-switching and query translation challenges consistently slowed down our SOC analyst response times. Our incident documentation fell behind our active threat hunt, making timeline reconstruction a major constraint during our post-incident reviews. We addressed this challenge by building a workflow with Cribl that bridges the gap between active threat hunting and real-time incident logging.

In this session, we will walk you through the highlights of our annual nation-wide live-fire exercise (codename: Trident). We will demonstrate how our SOC analysts utilised the "Run Investigation" feature in Cribl Search to launch natural-language queries and how we leveraged Cribl Notebooks as our live war room. We will share how this combined approach eliminated constant tool-switching, automated our post-incident review reporting, and improved our overall Mean Time to Resolution (MTTR).

Attendees will learn:

• How to use the "Run Investigation" workspace to bypass query translation hurdles and allow analysts to search across diverse security datasets.
• A method for configuring Cribl Notebooks to consolidate active threat hunts, including executable search queries alongside real-time SOC analyst notes to maintain a single, collaborative source of truth during an incident.
• A practical workflow for capturing live investigative steps and search history to automatically reconstruct chronological attack timelines, removing the manual documentation constraints that delay PIR reporting.

Speaker:

• Lindbergh Caldeira, Cyber Security Operations Manager, South Australia Power Networks

What happens when endpoint data collection gets too fragmented, too manual, and too hard to manage? Pacific Northwest National Laboratory will share how they tackled that challenge with Cribl Edge, simplifying endpoint data collection and reducing agent sprawl. In this session, attendees will hear how PNNL replaced file monitoring, scripted inputs, and metrics collection from multiple tools across Windows, Linux, and Mac endpoints with a single centrally managed approach.

Attendees will leave with practical lessons learned and clear examples for getting started, organizing Fleets, consolidating agents, improving data quality, and monitoring performance at scale.

Attendees will learn:

• How to get started with Cribl Edge
• Best practices for organizing Fleets
• How to consolidate multiple agents into one approach
• Ways to improve data quality at the edge
• How to monitor endpoint performance effectively

Speaker:

• Justin Brown, Senior IT Engineer, Pacific Northwest National Laboratory

As data volumes grow exponentially, managing observability infrastructure at petabyte scale demands a fundamentally different approach. In this session, Scott Burger from ServiceNow — one of Cribl's largest global deployments — shares how his team has navigated the challenge of operating Cribl at massive scale, and how the rise of AI is reshaping what infrastructure management looks like in practice.

From lessons learned to evolving best practices, Scott will walk through the key shifts his team has made over the past year and what it means to future-proof an observability pipeline when the landscape is changing faster than ever. This session is ideal for anyone responsible for observability, infrastructure, or data strategy at enterprise scale, especially those looking to understand how to operate and adapt in an AI-driven environment.

Attendees will learn:

• What managing Cribl at petabyte scale actually looks like inside a real enterprise environment
• How AI is changing infrastructure and observability strategy in practice
• Practical insights and lessons from one of the world's largest Cribl deployments
• How to think about adaptability and future-proofing when building observability pipelines

Speaker:

• Scott Burger, Lead Security Data Engineer, ServiceNow

When you're one of the largest telecommunications companies in Portugal, infrastructure doesn't just grow. It accumulates. Years of mergers and acquisitions left NOS's Cyber Defense team with a sprawling, heterogeneous environment: fragmented logging, blind spots, and a legacy SIEM that had become both a single point of failure and a vendor lock-in trap.

In this session, the NOS team shares how they broke that cycle by building a modern observability pipeline with Cribl Stream to unify over 40,000 event sources across hundreds of distinct technologies. We'll walk through four architecture iterations, from an initial deployment to a fully redundant, multi-datacenter design using border gateway protocols (BGP) anycast for transparent failover, Git-backed configuration-as-code, and a universal logging service as simple to consume as DNS or NTP.

You'll hear the real story: onboarding data sources nobody fully documented, navigating the political and technical inertia of a large enterprise, and how Cribl became the connective tissue that made every corner of every datacenter visible, searchable, and actionable.

Attendees will leave knowing how to:

• Achieve extreme scalability and redundancy with IP anycast
• Manage log source diversity in telco environments
• Architect for high-volume rollout: prepare once, scale many

Whether you're dealing with M&A sprawl, legacy SIEM fatigue, or trying to turn logging into a scalable enterprise service, this session delivers the architectural playbook and the hard-won lessons to do it right.

Speakers:

• João Marono, SOC Engineer, NOS Communications
• Miguel Viana, SOC Engineer, NOS Communications

Metrics are exploding. AI workloads, Kubernetes environments, and modern applications are generating more telemetry than ever—driving up costs while making it harder to find the signals that matter. Teams need a way to scale observability without sacrificing visibility, speed, or the workflows they rely on.

In this session, we’ll introduce Cribl’s modern, AI-native metrics capability built into the Cribl Search lakehouse engine. Learn how to ingest, store, visualize, analyze, and alert on massive volumes of metrics data with investigation-ready access in seconds. We’ll show how Cribl helps reduce metrics costs, support high-cardinality environments, simplify Prometheus/Grafana migrations, and accelerate troubleshooting with built-in detection capabilities.

You’ll learn how to:

• Reduce metrics spend without losing observability
• Handle high-volume infrastructure, application, Kubernetes, and AI telemetry at scale
• Detect issues faster with native querying, visualization, and multiple detection methods
• Modernize your metrics strategy without disrupting existing workflows

For platform engineers, observability leads, and anyone ready to go deeper on metrics.

Speakers:

• David Cavuto, Director, Product Management, Cribl
• Roman Trusov, Staff Software Engineer, Cribl

Filtering and dropping data gets you so far, and we’ll do that here. But rolling logs to metrics gets you further.

In this lab, you'll get the basics of data reduction AND get hands-on with converting high-volume log data into metrics inside Cribl Stream. Get better insights at a fraction of the storage with faster search times. You'll learn when it makes sense, how to do it right, and walk away with techniques you can apply to your own data now.

What does it actually take to get control of telemetry in a large, real-world healthcare environment? In this session, learn how a healthcare organization operationalized over 20,000 Cribl Edge nodes and Cribl Stream to take ownership of security data before it ever hits downstream platforms. 

You will hear how shifting processing left by shaping and dropping data at the edge can reduce costs while making day-to-day operations more manageable, not more complex. We’ll break down how we manage Edge at scale, push configuration changes quickly across thousands of systems, and make intentional decisions about what data to keep, reduce, or route—without losing what matters for investigations.

Attendees will learn:

• How we use Cribl Edge and Cribl Stream Stream to shape, optimize, and route telemetry before it drives downstream cost
• Lessons learned managing 20K+ agents, including fast, reliable configuration changes across the environment
• Strategies that cut log volume by 80%+ while preserving the data you actually need for detection and investigation

If you’re trying to control costs, simplify operations, or just get your telemetry strategy under control, this session will give you a practical model you can take back and apply.

Speaker:

• Nate Wood, Sr. Security Engineer, Health System

Building a Cribl Pack is one thing. Building one that works in your environment, someone else's environment, and prod at 2am is a different skill set entirely.

In this lab, VisiCore's Paul Stout brings the hard-won knowledge of someone who has built Packs, broken Packs, and figured out exactly why. You will get hands-on with a REST collector-based Pack and walk through the decisions that separate a Pack that holds up from one that falls apart the moment it leaves your laptop.

Expect real tips on auth, structure, and portability that you won't find in the docs. Leave with a repeatable approach you can trust when you get back to your own environment.

As observability environments grow, custom integrations can become difficult to maintain, secure, and scale. In this session, we’ll share how United Wholesale Mortgage evolved from a custom Cribl-to-Dynatrace webhook architecture to a modern observability strategy using native Cribl Destination integrations, OpenTelemetry Protocol (OTLP), semantic normalization, and custom data enrichment. We’ll discuss challenges encountered with custom destinations, lessons learned during migration, operational benefits gained, and how Cribl is helping prepare our organization for future observability initiatives.

Attendees will leave this session:

• Understanding the tradeoffs and failure points encountered with custom integrations, and the practical lessons that made the new model easier to secure, scale, and operate.
• Strategies in Cribl to normalize, enrich, and standardize telemetry data landing in Dynatrace (or other destinations), to promote efficiency of downstream relational context, incident operations, and future automated workflows.
• With a HTTP/OTLP Post-Processing Cribl Pack you can quickly integrate your telemetry into the Dynatrace ecosystem via Cribl.

Speakers:

• Kristen Emmanuel, Observability Administrator, United Wholesale Mortgage
• Byron Kenan, Observability, Event Log Management Lead, United Wholesale Mortgage
• Randy Corelli, Staff Customer Success Engineer, Cribl

Ready for a schema aware and lightning fast search experience? We’ve got just the thing: Lakehouse Engine Search. It can ingest your data, recognize its structure, and organize it into queryable datasets automatically.

In this lab, you'll get a Lakehouse Engine running, understand how datatypes and dataset intelligence shape your data, and write KQL queries to pull answers out of it. Or try out natural language queries and let the engine do the work.

By the end, you'll have hands-on experience with every layer: from getting data in to getting results back.

How do you move from traditional, human-driven defense-in-depth to an AI-enabled security model that responds in seconds? At Copart, that question is reshaping our approach to security telemetry, with Cribl serving as the foundational data plane.

Explore how Copart transitioned from SIEM log optimization to a centralized telemetry strategy, creating the necessary flexibility to power emerging AI-driven security workflows. We’ll walk through the architecture that provides agility across diverse tools, and the people and process work—governance, change management, and alignment—required to mature AI initiatives into repeatable operations.

This session provides the strategic framework and practitioner insights to help you:

• Architect a centralized data plane to enable dynamic, AI-driven security operations.
• Maintain tool-agnostic flexibility across SIEMs, data lakes, and cloud tools without rebuilding pipelines.
• Operationalize AI through essential governance and organizational alignment.
• Accelerate outcomes by reducing log onboarding from hours to minutes, improving MTTD and MTTR.
• Follow a proven adoption path from SIEM optimization to AI/agent enablement.

Speakers:

• Alexander Ondrick, Cyber Security Operations Senior Manager, Copart
• Aakash Sahu, Senior Cyber Security Engineer, Copart 

AI adoption is moving fast — but most organizations are flying blind. They lack visibility into what their LLMs are doing, how users consume tokens, and how AI is used across the enterprise. The warning signs often show up after the fact: unexpected usage spikes, surprise bills, and growing concerns around AI governance. Organizations need a way to understand AI activity at scale, without adding more complexity.

Monitoring AI activity across fragmented environments requires heavy instrumentation, custom integrations, and significant development effort — leaving organizations with mountains of data but little actionable insight.

This session introduces a new approach to AI observability built on Cribl. We’ll show how teams can capture 100% of enterprise AI activity with near-zero manual configuration and automatically turn LLM traffic into actionable insights through interactive analysis — without building and maintaining complex pipelines or storage.

You’ll learn:

• How to achieve frictionless AI instrumentation: Build enterprise-wide visibility into AI usage without the overhead of custom development or extensive engineering resources.
• How to extract value from AI activity data automatically: Analyze LLM prompts, responses, metadata, and usage patterns to uncover operational, security, and business insights.
• How to move from AI blind spots to AI confidence: Understand what your AI systems are doing, how they’re being used, and where opportunities or risks exist.

If your organization is adopting AI faster than it can understand it, this session will show you what’s possible when AI observability across all your teams and models. 

Speakers:

• Pardhu Gunnam, Head of Engineering, Data Insights, Cribl
• Seyi Adebajo, Staff Engineer, Cribl

Manual configuration doesn’t scale. Click-ops creates drift, audit gaps, and migration challenges—and AI workloads are accelerating the problem by generating inference logs, model metrics, prompt traces, and compliance data faster than teams can manage through a UI.

This session introduces the Cribl Terraform Provider as the foundation for managing telemetry environments as code. See a live demo that exports an existing Cribl configuration—including Sources, Destinations, Pipelines, Routes, and Packs—into reviewable Terraform, then uses it to move configuration from on-premises to Cribl.Cloud or between workspaces.

You’ll also hear directly from Optiv about their real-world approaches using Terraform to standardize and customize managed customer environments.

Key takeaways:

• Convert existing Cribl configurations into Terraform using the Cribl Terraform Config Exporter, accelerating on-premises and Cloud migration.
• Build auditable, repeatable telemetry pipelines that support enterprise governance and compliance requirements.
• Structure modular Terraform for complex routing across sources, environments, customers, and workspaces.
• Apply workspace-as-code patterns for multi-tenant and MSSP environments, enforcing a “Gold Standard” while allowing controlled customization.
• Rapidly provision and govern telemetry pipelines for observability, security, OpenTelemetry, and AI/ML workloads.
• Learn practical adoption lessons from Optiv, including where Terraform creates value and how it fits different operating models.

Speakers:

• Brian Rampley, Principal Engineer, Optiv
• Karan Haribhakti, Staff Product Manager, Cribl
• Kishore Korathaluri, Staff Site Reliability Engineer, Cribl

Modern Security Operations Centers are facing an "exponential data tax"—the cost of managing, storing, and analyzing an ever-increasing volume of telemetry is outpacing security budgets and slowing response times. This session explores how forward-thinking organizations are evolving beyond traditional, reactive SIEM models to build an Autonomous SOC. Learn how combining a vendor-agnostic data pipeline (Cribl) with an AI-native security platform (Cortex XSIAM) transforms the SOC from a cost center into a resilient security engine. We will discuss real-world architectural strategies for filtering, routing, and enriching data to feed AI models, allowing your analysts to move away from tool-swapping and toward high-fidelity, agentic investigation and response.

Speaker:

• David Falcon, Transformation Success Architect, Palo Alto Networks

What does it take to run Cribl not just successfully, but sustainably at scale? In this session, Cribl Product Managers Charles Hills and Alex Parella will showcase products and features within Cribl.Cloud that help teams move from a single-team deployment to a holistic platform that supports the broader enterprise.

Through a product-focused, demo-oriented walkthrough, they’ll highlight how capabilities like Cribl Insights, FinOps Center, and Identity and Access Management with RBAC help organizations gain stronger cost visibility, enforce governance, and support users with confidence. Attendees will see how to make it easier to manage access, understand usage, control spend, and operate Cribl as a secure, scalable operation.

Whether you’re running Cribl for your own team or building it into a shared platform across your organization, this session will show how to provide the operational foundation to grow with clarity, control, and scale.

Speakers:

• Charles Hills, Senior Product Manager, Cribl
• Alex Parella, Senior Product Manager, Cribl

We might have 99 problems but our agent shouldn’t be one. Come learn the fundamentals of our data collection agent: Cribl Edge.

In this lab, you’ll learn how to deploy and manage your fleets of agents. Get the lowdown on setting up collection, best practices, and maximizing your license. You’ll use the unique capabilities like teleporting and leveraging Search to interrogate your nodes. If you’re exploring your agent options then this is the lab for you.

Getting OTEL data into Cribl Stream has its tricks. Knowing what to do with it once it's there takes even more know-how.

In this lab, you'll cover how to get OTEL data in the door, what it looks like inside Stream, and how to shape, route, and optimize it through your pipelines. Learn real patterns you can take back and use.

Security operations were built for a world where humans investigated alerts after data was already centralized and stored. That model is breaking down.

SIEM costs are exploding, telemetry volumes are surging, and AI is raising the stakes on both sides — attackers are moving faster, and defenders now need enriched, high-quality data available before a query ever runs. Traditional SIEM-centric architectures weren't built for this.

This session makes the case for shifting detections into the stream–evaluating, enriching, and correlating data in motion, before it’s ever indexed–and ensuring detections’ resilience as schemas and configurations drift. We’ll explore the architectural and operational challenges driving this shift, why AI makes in-stream detections not just better but necessary, and how we’re evolving CardinalOps technology after the acquisition to bring this vision to life. 

You'll leave with:

• A clear picture of what "detections in the stream" actually means in practice
• Strategies for cutting SIEM costs without sacrificing visibility
• An understanding of why AI accelerates the case for architectural change in the SOC

For SOC leaders, detection engineers, security architects, and platform teams modernizing their detection strategy for the AI era.

Speakers:

• Bani Shahbaz, Head of Engineering, Security Products, Cribl
• Jack Coates, Sr. Director Product Management, Cribl

We're handing you a broken environment. Nothing personal; it's educational.

In this lab, you'll work through real issues pulled from actual customer environments across Cribl Stream, Edge, and Search. Fix bad configs, pipeline problems, and the kind of mistakes that seem obvious in hindsight. For each scenario, you'll see what the problem looks like, understand why it happens, and walk through how to fix it.

Come out knowing what to look for before things go sideways in your own environment.

Help shape the future of Cribl's AI Observability offerings! Get hands-on with our AI O11y app and give feedback on what we have and where you'd like us to go next!

Help shape the future of Cribl's user experience! Give feedback on prototypes that demostrate what AI-first Cribl UX could look like. 

Help shape the future of Cribl's Security offerings! Give feedback on prototypes and builds that allow you to detect, enrich, correlate, and investigate all backed by the power of the Cribl platform.