Cribl is the Data Engine for IT and Security! This course explores newly released features in the Cribl suite of products. Come check out the cool new stuff we did to make your life better!
","showTerminal":false,"showStream":false,"type":"course","startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"search-operators","title":"Cribl Search Operators","subtitle":"1 language, limitless possibilities.","imageUrl":"/images/search.png","description":"Want to know more about how to search data in place? You're in the right place! This course is a deep dive of Cribl Search's Search Language based on KQLL.
You'll need a Cribl.Cloud account for this course. No need to worry, you can create one after starting.
","showTerminal":false,"showStream":false,"type":"deepDive","startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"object-store-archive","title":"Archiving to Object Storage","duration":"10 minutes","type":"tutorial","description":"In approximately 10 minutes, this course will guide you through the process of configuring Cribl Stream to archive all incoming raw data to cost-effective storage (Cribl Lake) for use later.
","showTerminal":false,"showStream":false,"startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"search-dashboards","title":"Cribl Search Dashboards","subtitle":"Oh what a view.","imageUrl":"/images/search.png","description":"Use Cribl Search dashboards to create stunning visuals of your disparate data in place. This course covers the basics of creating Cribl Search Dashboards.
You'll need a Cribl.Cloud account for this course. No need to worry, you can create one after starting.
","showTerminal":false,"showStream":false,"type":"hidden","startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"overview-search","title":"Cribl Search","subtitle":"Search any data, any vendor, any format, from one location, using one query language.","imageUrl":"/images/search.png","description":"Want to know more about how to search data your at rest? You're in the right place! This course covers the basics (and a little more) of Cribl Search.
You'll need a Cribl.Cloud account for this course. No need to worry, you can create one after starting.
","showTerminal":false,"showStream":false,"type":"course","startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"overview-lake","title":"Cribl Lake","subtitle":"Come in, the data's nice.","imageUrl":"/images/lake.png","description":"In approximately 15 minutes, this course will showcase the capabilities of Cribl Lake (and the Cribl product suite).
Ever wonder why data lakes are hard? What is a data lake? Why should I use one? Wonder no longer!
","showTerminal":false,"showStream":false,"type":"course","startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"enrichment","title":"Data Enrichment","duration":"10 minutes","type":"tutorial","description":"Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy, enabling customers to collect, process, route, and analyze all IT and security data.
This 10-minute course walks through enriching data with GeoIP and items from a threat list (CSV).
","startupTime":200,"tabTitles":["Kibana - Map","Kibana - Events"],"tabs":["${window.location.protocol}//port-5601-${host}.${domain}/app/maps/map/8e264ba0-3ada-11ee-82da-fb9bdaaef6da","${window.location.protocol}//port-5601-${host}.${domain}/app/discover"],"enableTerminal":false},{"id":"demo-search","title":"Federated Search Demo","duration":"15 min","imageUrl":"/images/criblinfinitygaunt.png","description":"In approximately 10 minutes, this course will guide you through the process of configuring Stream to collect raw data from a PostgreSQL database.
","startupTime":120,"showTerminal":false,"tabTitles":["Terminal"],"tabs":["${window.location.protocol}//port-27425-${host}.${domain}/"]},{"id":"data-collection","title":"Advanced Collection & Replay","duration":"30 minutes","type":"deepDive","description":"Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy. This 30-minute course walks through ad-hoc data collection in Cribl Stream, which can replay data from low-cost storage.
","startupTime":200,"tabTitles":["Kibana - Events","Kibana - Dashboard"],"tabs":["${window.location.protocol}//port-5601-${host}.${domain}/app/discover#/?_a=(columns:!(),filters:!(),index:'6f483a5a-5a2c-4a63-ad27-fc5541a140ee',interval:auto,query:(language:kuery,query:''),sort:!(!('@timestamp',desc)))&_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:'2021-05-05T05:00:00.000Z',to:'2021-05-10T05:00:00.000Z'))","${window.location.protocol}//port-5601-${host}.${domain}/app/dashboards#/view/95e83c10-3ac4-11ee-89c7-c5adc65a19b0"],"enableTerminal":false},{"id":"event-breaking","title":"Event Breaking","duration":"60 minutes","description":"This course explores configuring Event Breakers and timestamp extraction on various Sources in Cribl Stream.
","enableTerminal":false,"type":"deepDive","startupTime":120},{"id":"data-shaping","title":"Data Shaping In Cribl Stream","duration":"10 minutes","type":"tutorial","imageUrl":"/images/datashaping.png","description":"This 10-minute course walks through a simple use case of reshaping JSON event data using Cribl Stream. It covers unrolling (splitting a JSON payload with a list into multiple events), parsing, flattening and cleaning the data.
","showTerminal":true,"startupTime":120},{"id":"data-shaping-crwd","title":"Data Shaping In Cribl Stream","duration":"10 minutes","type":"hidden","imageUrl":"/images/datashaping.png","description":"This 10-minute course walks through a simple use case of reshaping JSON event data using Cribl Stream. It covers unrolling (splitting a JSON payload with a list into multiple events), parsing, flattening and cleaning the data.
","showTerminal":true,"startupTime":120},{"id":"replay-raw","title":"Full Fidelity Replay","duration":"10 minutes","type":"tutorial","description":"Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy. In approximately 10 minutes, this course will guide you through the process of collecting archived data from an S3 instance. Then you will push the data through Cribl Stream and into a new vendor's SIEM solution. No more pesky vendor lock-in!
","startupTime":120,"enableTerminal":false},{"id":"deepdive-stream","title":"Getting to Know Cribl Stream","duration":"90 minutes","description":"This course explores Cribl Stream's lookup functionality, showing exact match, regex, and CIDR lookups.
","startupTime":120},{"id":"search-data-sources","title":"Cribl Search Data Sources","subtitle":"Point, Search, Done. ","duration":"15 min","imageUrl":"/images/search.png","description":"Learn how to configure any data as a Data Source within Cribl Search.
","showTerminal":false,"showStream":false,"type":"tutorial","startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"replay-breach","title":"Into the Breach: Security Breach Replay","duration":"12 minutes","type":"hidden","description":"In approximately 10 minutes, this course will guide you through the process of collecting archived data from an S3 instance for use in identifying a security breach. Then you will create a new pipeline, enriching the data differently than before. Once new enrichment is configured, you will push the data into the security team's SIEM solution.
","startupTime":120,"enableTerminal":false},{"id":"replay-breach-crwd","title":"Into the Breach: Security Breach Replay","duration":"12 minutes","type":"hidden","description":"In approximately 10 minutes, this course will guide you through the process of collecting archived data from an S3 instance for use in identifying a security breach. Then you will create a new pipeline, enriching the data differently than before. Once new enrichment is configured, you will push the data into the security team's SIEM solution.
","startupTime":120,"enableTerminal":false},{"id":"gitops","title":"Managing Stream with GitOps","duration":"30 minutes","type":"hidden","description":"This 30-minute course gives you the skills needed to manage your Cribl Stream instance via GitOps.
","startupTime":120,"showStream":false,"tabTitles":["Stream Dev","Stream Prod","Gitea","Terminal","Elasticsearch/Kibana"],"tabs":["${window.location.protocol}//port-9000-${host}.${domain}/login?username=admin&password=cribldemo","${window.location.protocol}//port-9001-${host}.${domain}/login?username=admin&password=cribldemo","${window.location.protocol}//port-8081-${host}.${domain}/","${window.location.protocol}//port-27425-${host}.${domain}/","${window.location.protocol}//port-5601-${host}.${domain}/app/discover"]},{"id":"rest","title":"REST API Collector","duration":"","description":"This course explores how to configure the Cribl Stream REST API Collector for authentication, discovery, and collection of JSON data from a REST API endpoint.
","type":"deepDive","showTerminal":false,"showStream":false,"startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"regex","title":"Regex 101","duration":"10 minutes","type":"tutorial","imageUrl":"/images/logstreamfund.png","description":"This course walks you through using regular expressions (regex) in Cribl applications to efficiently extract and transform your data.
","startupTime":120,"enableTerminal":false},{"id":"edge-k8s","title":"Kubernetes Observability with Cribl Edge","duration":"45 minutes","type":"hidden","description":"This course explores how to install the Cribl Edge Helm Chart on a Kubernetes cluster and how to configure various sources to increase observability of Kubernetes.
","startupTime":300,"enableTerminal":false,"tabTitles":["Grafana","Terminal"],"tabs":["${window.location.protocol}//port-3000-${host}.${domain}/","${window.location.protocol}//port-27426-${host}.${domain}/"]},{"id":"custom-pack","title":"Roll Your Own Pack","duration":"10 minutes","type":"tutorial","description":"In approximately 10 minutes, this course will guide you through the process of importing a custom pack to Cribl Stream and then putting it into production.
","startupTime":120,"enableTerminal":false},{"id":"expressions","title":"Understanding JavaScript Expressions","duration":"10 minutes","type":"tutorial","description":"This 10-minute course walks through the JavaScript Expression capabilities in Cribl Stream for filtering and field extraction
","startupTime":140,"enableTerminal":false},{"id":"windows-xml-event-reduction","title":"Windows XML Event Reduction","duration":"10 minutes","type":"tutorial","description":"Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy. This course walks through the creation of a Windows XML reduction Pipeline in Cribl Stream.
","showTerminal":true},{"id":"metrics","title":"Working with Metrics","duration":"15 minutes","type":"hidden","description":"Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy. This 15-minute course walks through the functions in Cribl Stream that can be used to convert logs into metrics.
","startupTime":140,"enableTerminal":false,"tabTitles":["InfluxDB"],"tabs":["${window.location.protocol}//port-8086-${host}.${domain}"]},{"id":"data-tiering","title":"Data Tiering & Search Optimization","subtitle":"Multi-tier storage strategy with forensic search capabilities","imageUrl":"/images/search.png","description":"Learn how to build a cost-effective data architecture that enables forensic investigations without exploding your budget. You'll install pre-built packs to create a multi-tier storage strategy and master search techniques that help you find needles in haystacks—then send only the relevant data downstream.
Duration: 30 minutes
Key Skills: Data tiering, forensic search, query optimization, selective export
Cost Savings: Learn patterns that save 94% on storage costs
You'll need a Cribl.Cloud account for this course. No need to worry, you can create one after starting.
","showTerminal":false,"showStream":false,"type":"deepDive","startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"overview-stream","title":"Cribl Stream","subtitle":"Getting data to the right places, in the right formats, at the right time","duration":"","type":"course","imageUrl":"/images/overview-stream.png","description":"In approximately 10 minutes, this course will fly you through the main features of Cribl Stream.
Cribl Sandbox courses use our actual products - cloud hosted, on-demand,and with its own event generators - no need to configure anything external!
This Cribl Stream overview flies through a completely configured Stream to quickly expose you to the UI.
","showTerminal":false,"showStream":false,"startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"overview-copilot","title":"Cribl Copilot","subtitle":"Launch it, you're in good hands.","duration":"","type":"course","imageUrl":"/images/copilotteal.png","description":"In approximately 15 minutes, this course will showcase the capabilities of Cribl Copilot and Cribl Guard (and the Cribl product suite).
Ever wonder what AI Cribl has in the products? Wonder no longer!
","showTerminal":false,"showStream":false,"startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"edge","title":"Cribl Edge","subtitle":"An intelligent, highly scalable edge-based data collection system","duration":"","type":"course","imageUrl":"/images/edge.png","description":"Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy, enabling customers to collect, process, route, and analyze all IT and security data. This tutorial walks you through the basics of Cribl Edge.
","startupTime":120,"showTerminal":false,"tabTitles":["Prometheus","Terminal"],"tabs":["${window.location.protocol}//port-9090-${host}.${domain}/graph","${window.location.protocol}//port-27425-${host}.${domain}/"]},{"id":"overview-dispensary","title":"The Dispensary","subtitle":"A place to share and care","duration":"","type":"course","imageUrl":"/images/dispensary.png","description":"In approximately 10 minutes, this course will guide you through a visit to the Dispensary. There you'll pick up a dank pack and then light it up in Stream. Noice.
","startupTime":120,"enableTerminal":false},{"id":"dangerous-dave","title":"Dangerous Dave Demo","subtitle":"Proof of concept for in-booth gamification and engagement","duration":"","type":"hidden","imageUrl":"/images/dangerous-dave.png","description":"In it's final form, almost all of the following steps and actions will be self-contained and completely cloud-hosted. For this first trial balloon, several steps will be manual, and some things will be running locally on your machine.
So strap in because - while this isn't going to be a particularly rough ride, it is going to be a journey of discovery!","showTerminal":false,"showStream":false,"startupTime":30,"cloud":true,"tabTitles":["Cribl.Cloud"],"tabs":["${cloudUrl}"],"provider":{"platform":"cloud"}},{"id":"appscope","title":"AppScope","subtitle":"Visibility: No configuration or agent","duration":"","type":"hidden","imageUrl":"/images/appscope.png","description":"This course walks AppScope, black box instrumentation for any Linux binary. AppScope aims to make application monitoring as ubiquitous infrastructure monitoring. Observe anything just by prepending scope. Appscope Fundamentals shows off the power of the scope CLI.
In this lab, you will configure Edge Nodes to forward data to Cribl Stream.
","startupTime":120,"enableTerminal":false},{"id":"edu-edge-deep-dive-02","title":"Edge Deep Dive Lab 02","duration":"30 minutes","type":"classlab","description":"This lab will guide you through installing Cribl Edge on Linux hosts.
","startupTime":120,"enableTerminal":false,"tabTitles":["Terminal"],"tabs":["${window.location.protocol}//port-27427-${host}.${domain}/"]},{"id":"edu-edge-deep-dive-01","title":"Edge Deep Dive Lab 01","duration":"20 minutes","type":"classlab","description":"This lab will explore Edge Fleet management capabilities.
","startupTime":120,"enableTerminal":false},{"id":"demo-standard","title":"Standard Demo","duration":"30 minutes","type":"demo","imageUrl":"/images/demo-standard.png","description":"This environment is built to support the Standard demo
To show the docs, click the Page icon at the bottom left of the UI.
","startupTime":900,"showTerminal":false,"showDocs":false,"tabTitles":["Terminal"],"tabs":["${window.location.protocol}//port-27425-${host}.${domain}/"]},{"id":"demo-security","title":"Security Use Case Demo","duration":"30 minutes","type":"demo","imageUrl":"/images/demo-pandulce.png","description":"This environment is built to support the GeoIP demo
","startupTime":900,"showTerminal":false,"showDocs":false,"tabTitles":["Kibana - Map","Kibana - Events","Terminal"],"tabs":["${window.location.protocol}//port-5601-${host}.${domain}/app/maps/map/8e264ba0-3ada-11ee-82da-fb9bdaaef6da","${window.location.protocol}//port-5601-${host}.${domain}/app/discover","${window.location.protocol}//port-27425-${host}.${domain}/"]},{"id":"demo-ocsf","title":"OCSF(Open CyberSecurity Schema Framework) Demo","duration":"30 minutes","type":"demo","imageUrl":"/images/ocsflock.png","description":"This environment is built to support the OCSF demo
","startupTime":900,"showTerminal":false,"showDocs":false,"tabTitles":["Terminal"],"tabs":["${window.location.protocol}//port-27425-${host}.${domain}/"]},{"id":"demo-o11y","title":"O11y Standard Demo","duration":"30 minutes","type":"demo","imageUrl":"/images/strangerthings_o11y.png","description":"Zeek Zeek Zeek
","startupTime":210,"showTerminal":false,"tabTitles":["Terminal"],"tabs":["${window.location.protocol}//port-27425-${host}.${domain}/"]},{"id":"fl-06-replay-breach","type":"redirect","target":"replay-breach"},{"id":"fl-05-replay-raw","type":"redirect","target":"replay-raw"},{"id":"fl-04-custom-pack","type":"redirect","target":"custom-pack"},{"id":"fl-03-dispensary","type":"redirect","target":"overview-dispensary"},{"id":"fl-02-s3archive","type":"redirect","target":"s3archive"},{"id":"fl-01-overview","type":"redirect","target":"deepdive-stream"}]