Cribl Search Pack for Corelight demo: Network analytics, SIEM cost savings, and threat detection

See how to use the Cribl Search Pack for Corelight to explore network activity, control SIEM costs, and investigate threats using prebuilt dashboards. This short walkthrough is for security and observability teams running Corelight sensors with Cribl Search and Cribl Stream who want faster insights with less noisy data. You’ll see how the pack’s six dashboards help you: - Use overview and detail dashboards to visualize Corelight-detected activity, traffic types, and trends over time, with time pickers and sensor filters for focused analysis. - Build a data tiering strategy with Cribl Stream by excluding noisy, known-good traffic from your SIEM, keeping it in object storage, and still searching it with Cribl Search—often reducing DNS and HTTP volumes by over 90% in the example shown. - Use the threat detection dashboard to group Corelight alerts, spot potential attack activity, detect port scanners, and surface servers with TLS issues. - Leverage the certificate dashboard to find systems with expired certificates or suspicious, non-matching SNIs. - Investigate hosts with the IP activity dashboard, pivoting on source/destination IPs and ports to see related DNS queries, HTTP and TLS activity, and accessed files in one place. By the end, you’ll understand how to combine Corelight telemetry with Cribl to get richer network visibility, lower SIEM ingestion, and faster investigations using out-of-the-box dashboards. 00:00 Overview: Corelight pack for Cribl Search v1.0 and included dashboards 00:20 Corelight overview and detail dashboards (traffic types, trends, HTTP/DNS/TLS metrics) 01:00 Data tiering dashboard for Cribl Stream and SIEM cost savings (DNS/HTTP/TLS examples) 01:50 Threat detection dashboard (alerts, attack activity, port scanning, TLS issues) 02:15 Certificate dashboard (expired certificates and suspicious SNIs) 02:35 IP activity dashboard for host investigations (IPs, ports, DNS, HTTP, TLS, files) ## Follow Cribl LinkedIn: https://www.linkedin.com/company/cribl/ Twitter: https://www.twitter.com/cribl_io Sign up for a Cribl.Cloud account: https://cribl.cloud/signup/ Learn more about Cribl: https://cribl.io