Cribl Stream and Cribl Edge¶
TrackMe monitors Cribl with two dedicated tenant types, generally available since TrackMe 2.4.19:
a Cribl Stream tenant follows one Cribl Stream deployment end to end: the Leader, the Worker Groups, the Workers and their machines, and the Sources, Destinations, Pipelines and Routes, with traffic machine learning models on every data object;
a Cribl Edge tenant follows the Fleets of a Cribl Edge Leader: connectivity, version and configuration drift, the health of the Sources and Destinations reported by the nodes, and the disk, CPU and memory of every Edge Node, at any fleet size.
Like User Activity Monitoring, a Cribl tenant has no entities: its policies raise findings, which you triage, group, assign, act on and notify — see Findings, Finding groups and findings actions.
The Cribl documentation lives with the third party integrations:
Which Cribl tenant to use, how they work, and the Cribl connections.
Create a Cribl Stream tenant and explore its workspace.
Create a Cribl Edge tenant and explore its workspace.
To monitor the data sources and hosts whose logs pass through Cribl, with the DSM and DHM components, see Monitor data sources and hosts with Cribl signals.