– Up to £150k annual savings on licensing from reduction of data sent to SIEM
– Reduced time to implement data feed from two days FTE to half a day
– 40% reduction in data ingestion to SIEM

The challenge

When it comes to balancing visibility and spending, Security Incident Event Managment (SIEM) licensing models can be somewhat restrictive—something a multinational, born in the cloud technology company was becoming painfully aware of.

The organisation wanted to improve its security posture by ingesting more data feeds into its SIEM. However, its cybersecurity team found itself hampered by license limitations and prevented from feeding in more data by license utilisation caps.

Faced with excessive additional licensing costs, the company needed an alternative solution that would optimise the ingestion of data, reduce license usage, and boost visibility across its environment—without breaking the bank.

Enter … Cribl 

Looking for the best solution to achieve their data goals, the company reached out to cybersecurity company RiverSafe for advice. Given its ability to optimise, route and enrich data, Cribl was chosen as a possible fit, and RiverSafe began a proof of concept to investigate the potential impact the product could have on the company’s data streams.

“We chose four data sources, and deliberately chose some of our most volumetric data sources. We had a success criterion in mind, and that was to send all these data sources to our SIEM environment via Cribl and see what kind of reduction we could get from a percentage perspective,”
the head of security programme management said.

“It’s seemed to be a very good product and much needed in the marketplace. There are many organisations like us who have the same kind of challenges and the same use case issues, whereby they don’t have the budget or inclination  to spend more and more money on their SIEM.”

Instant data ingestion reduction

After a successful proof-of-concept, the company opted to implement Cribl Stream.

“I know [Cribl Stream] and I knew its capability, so I had an inkling as to what the reduction rate could potentially be. What really surprised me was how easy it was to reduce the data feeds into the SIEM. I was really shocked at how seamless it was to introduce a layer like Cribl to assist with the data optimisation and reduction.”

After implementing Cribl Stream as an optimisation layer, the company reduced the amount of data being fed into its SIEM from around 750GB to 450GB.

“We were able to reduce our data ingest by about 40%, which matched our original success criteria around the percentage we hoped to reduce the data ingestion by. More importantly, what we were reducing were largely blank fields and null values, content that didn’t feed into our detection rules. We’re able to gain this headroom and cost savings without sacrificing visibility or increasing risk. ”

Streamlining data ingestion

An additional benefit the company experienced post-implementation was streamlined data ingestion. By pointing data through Cribl, the company is able to cherry-pick the data that’s sent to its SIEM, simplifying the onboarding process for new data feeds.

“Once we’ve pointed the data to Cribl, we’re able to pick and choose what data we send into the SIEM and what data we don’t. That’s made it a lot more efficient in terms of the way we onboard data, and it’s enabled us to be a lot more granular with the data that we ingest into our SIEM.”

Greater scalability

With the reduction in data ingestion levels, the company is less likely to run into issues due to SIEM licensing limitations. By employing Cribl to help manage its data, the company hopes to benefit from greater scalability and agility in the future.

“Going forward, we’ll have scalability from a visibility and coverage perspective without being constrained by a SIEM licence.”

This flexibility is just one of the wide-reaching benefits that the company has experienced since implementing Cribl, and one that’s made a major difference to its operations.

“Cribl gives you the flexibility to reduce data ingest, but also the flexibility to be agile and to move your data sources from one environment to another without much configuration. It’s given us the capability to be less rigid in our architecture; that’s been the biggest impact for us.”

Significant cost savings

Having cut data ingestion by 40% with Cribl Stream, the company is free to load more data feeds into its SIEM without the need to purchase additional licensing capacity.

This has not only allowed the company to increase visibility across its digital environment, but also cut down on licensing costs.

“Now that we’ve got Cribl in our architecture, we have the ability to ingest more data feeds without having to buy additional licencing—that’s already saved us money. If we didn’t have Cribl, that additional cost would have been between £120,000 and £150,000 per year, on top of what we’re already paying today for our SIEM.”

As well as reducing spending on SIEM licensing, the company has been able to cut costs in other areas.

“We’re completely in the cloud, so we’re charged for data that we retain for a longer period. Now that we have Cribl, we can send the data that we want to retain to a cheaper storage solution. And with Cribl Replay and Cribl Search, we still have the ability to easily search that data should we need it for audits or incident investigation. That gives us a cost benefit and more flexibility in the long run.”

Smarter resource utilisation

Cribl is also helping the company put its valuable resources to better use by cutting down on manual data management tasks.

Previously, its team had to configure multiple destinations when data was ingested. With Cribl, data from various locations can be ingested once and pointed to numerous locations around the business, eliminating the need for system and platform owners to configure multiple endpoints.

“Normally, it would’ve taken us about two days of FTE effort to implement a data feed into Splunk or a similar destination. Since the introduction of Cribl, we’ve cut that down to half a day because now we only need to configure to send to Cribl and Cribl takes care of translating the data into the ideal format for other destinations.”

This reduction in time and labour adds up to additional cost savings too. Now, the company can send just the data that’s relevant to a particular end user, rather than shipping the entire data set. This has helped save money on licensing, infrastructure/ compute, processing, and effort.

“Because we’re a cloud-native organisation, processing costs money—if we’re able to save on that, then we are definitely winning from a cost perspective.”

Highlights

• Up to £150k annual savings on licensing from reduction of data sent to SIEM
• Reduced time to implement data feed from two days FTE to half a day
• 40% reduction in data ingestion to SIEM

Book a consultation

Get the perspective and insight you need to create unified solutions and make informed business decisions.