AlphaSOC Data Lake for Cribl Search
New Release
You can now query the AlphaSOC Data Lake from Cribl Search. The data lake appears as a federated dataset, so you can reach the normalized OCSF telemetry and threat evidence we hold for your environment without ingesting it into Cribl. Queries use the same event, evidence, and activity commands as AlphaSOC for Splunk, and you can pipe the results into Cribl KQL operators from there.