Anomali Security Analytics can ingest event log data from Cribl Stream when it is routed through AWS Simple Storage Service (S3). Anomali provides the S3 bucket. Your organization must configure Cribl to send logs to it. Multiple Cribl streams from your organization can feed into a single S3 bucket. Anomali Security Analytics initiates queries via Anomali Cloud Link to retrieve logs from S3.

Getting Started

Contact Anomali Customer Support to get started. Anomali Customer Support will facilitate the onboarding and management of this log source type.

To learn about configuring Cribl to send data to S3, refer to Amazon S3 Destination.