News
More from RSA Conference 2023

Daniel Bernard

Chief Business Officer

CrowdStrike

Abby Strong

CMO

Cribl

Data choice and control play strong roles in how Cribl and CrowdStrike provide security solutions

When CrowdStrike Inc. launched its Falcon Fund investment vehicle in 2021, one of the first companies it chose to support was Cribl Inc. Three years later, that investment is making an impact in a number of ways.Aside from the most recent collaboration between the two firms to leverage Cribl’s data streaming expertise, the companies have been focused on giving customers full control over their data at a time when IT and security teams need to make better decisions.“At the heart of it, Cribl is an integrations company,” said Abby Strong (pictured, left), senior vice president of customer experience and marketing at Cribl

CrowdStrike partners with Cribl for seamless data transit

Enterprise solutions companies usually broker partnerships to improve existing products or ease end-user pain points.In keeping with the trend, endpoint security company CrowdStrike Inc. has announced a collaboration to leverage Cribl Inc.’s data streaming expertise moving forward.“What’s going on in the market is a lot of our customers are on this [extended detection and response] journey,” said Daniel Bernard (pictured, right), chief business officer of CrowdStrike. “They want to bring data into the platform and use CrowdStrike for everything — from security to DevOps use cases. Bringing data in with Cribl just is so much easier and faster

Info

Abby Strong | Cribl & Daniel Bernard | CrowdStrike

Daniel Bernard

Chief Business Officer CrowdStrike

Abby Strong

CMO Cribl

(upbeat music)

>> Hey, welcome back everyone, to theCUBE's live coverage of RSA Conference 2023 in Moscone. I'm John Furrier, host of theCUBE day two. Kind of feels like day one. Day one was yesterday but this is day two, full program. It's packed. Events are back. Steady state. We've got two great guests here. Abby Strong is the Senior Vice President of Customer Experience at Cribl. Thanks for coming on.

>> Yeah, thank you.

>> Congratulations. And Daniel Bernard, Chief Business Officer at CrowdStrike. Good to see you guys.

>> John, good to be here. >> Thanks for coming on.

>> Yeah, super excited. >> So, Cribl, CrowdStrike, partnership. We've got some news. Let's get that out of the gate. Let's hear the news.

>> Let's do it. >> Sure. Well, what's going on in the market is a lot of our customers, they're on this XDR journey. How do I bring data into the platform? How do I use CrowdStrike for everything? Not just security use cases, DevOps use cases as well. And bringing data in with Cribl just is so much easier, so much faster. Bringing data in was a big struggle. We've been working with Cribl a long time. They're a Falcon Fund company. Made an investment in them about a year and a half ago, and they've really emerged as a leader in the market in terms of this data transit. And bringing data in with with Cribl via our Falcon, our CrowdStream product, it's never been easier, it's never been faster and it's fully integrated.

>> Yeah, super excited. We've just been working together a long time, as he mentioned, really helping CrowdStrike EDR customers get their data into legacy SIEMs. And now with CrowdStream, we have a much easier way to get data into the CrowdStrike Falcon platform.

>> What I love about the news is that this is an example of where this market is right now. You have the explosion of new approaches and demand for the data. And it's got to be scalable and extensible and reliable and easy to use. And this is like, now the new table stakes and the pressure's on. So you guys bring that new product to the table. What made this work? What was the reason? Were you guys partnering? Can you expand on the relationship?

>> Sure. I think some of the best partnerships, they actually start organically. And so if you look at the way data is moving and where it was moving, Falcon platform, EDR data, very voluminous data. 70% of the data that we'd see in legacy SIEM products was coming from CrowdStrike. How was it getting to these SIEM products? It was going via Cribl. So it was really easy for us to listen to our customers and see this demand for the Cribl technology. The differentiation and this observability pipeline and for us to help route that right here into the data destination, which is our LogScale product in the Falcon XDR platform.

>> Yeah, we share a lot of customers in common already. And it was interesting seeing that grow from the field and then even as they were starting to look at LogScale and the opportunity that they have with that product. And to hear them go, "well, can you help us move data into this product?" And so we built a pack, made it really easy to move data over. And of course, that turned into, well, how do we get that inside the CrowdStrike interface to make it even easier for customers to-

>> Take us through how it works because this is a big deal. And I think, again, I've talked to the founders at Cribl many times when they started. They just build product and then they... What's your go to... We just go to customers, they've got a problem, we just build it for them, next thing they're working together. And now you've got data as large scale, the plumbing's there. Talk about how it works with CrowdStrike so people can understand the connections.

>> Sure. So it starts like this, and we're going to do it live so you see what the customer experience is. You log into our platform, there's a button, it says CrowdStream powered by Cribl. You click the button and that starts your data journey of bringing the data in. That's where Cribl comes into play.

>> Yeah. And so customers can choose, we have a very easy and intuitive interface with a thousand integrations for all the different source types that they might have. And it allows for customers just to immediately go, "Which sources am I interested in moving into the Falcon LogScale platform?" And then just literally drag and drop and say, "send it to LogScale now." And we'll automatically process, parse it, forward it and then format it in the right way so we can land it there.

>> That's so easy. We're done. I mean, okay. (Abby laughing) Okay, that's a wrap guys. No, I mean that's kind of the way it's supposed to be. Okay, what's the impact to customers? Are you guys going to go to market together? Talk about the relationships.

>> Sure. >> What's the plan?

>> We're going to market together, but what makes this really, really wonderful for our customers, we've got over 26,000 customers, and great for Cribl, is we make it so easy. Like you said, what's the big barrier to XDR? The big barrier to XDR is, okay, you've got the CrowdStrike data, that's endpoint, that's cloud, that's workload, that's identity.

>> John: Explain XDR real quick before-

>> Sure. So XDR, it really starts with where we were with EDR, endpoint detection and response. And CrowdStrike pioneered, created, owns the EDR category. Endpoint, you want to do prevention, detection and response. So the D and the R is detection and response. How do you keep an endpoint safe today? That's EDR. Enterprises are sitting there saying, "Wait, we want to do it beyond the endpoint. We want this protection layer, this visibility layer across everything." And that's where we start getting into data and attack surfaces that aren't CrowdStrike. And that's where the X comes in. Extended detection and response. So if you're trying to move to XDR, it really becomes more of a data based, a data defined problem. How do you get the visibility over the data? How do you bring it to one place? And we are the one place. And in order to be the one place we need to make data in really, really easy.

>> Well, first of all, I want to say congratulations to CrowdStrike. We follow a lot of the public stock metrics. Dave does. Like you read about it, Dave's much more on that, but the metrics are all doing great on the business side. So congratulations. This, working with other companies has become a connection business, where API is in the cloud, data connects to data, people are working together, clean rooms are being discussed everywhere you talk about. So this is like a connector on steroids, seems like.

Is that kind- >> A little bit. I mean, at the heart of it, Cribl is an integrations company. And so what we spend our time and attention is on where is all of the data? And then how do we get it to the various destinations? And in this case, specifically LogScale. But really, we were formed to help customers overcome this problem. Data is growing at a 25% CAGR. That means in five years you're going to have 250% more data than you have today-

>> That might be understated, by the way.

>> And a lot of it is coming from EDR, if we're being quite honest, as you said, 60 to 70%. And so how do you get in front of that, make sure that you can put it where it needs to go? And then once you have that as the gravity that comes with that amount of data, how do you get your other data in there? Where's your firewall data? Where are inputs from other parts of the business that you can use to solve problems?

>> It's like filling up the gas tank, you just go pump it in. So what's the use case? What's the driver here? More visibility? Is it more data for all those solutions you guys are driving? Is the customers saying I have bespoke data? Is they have a tool? Are they replacing something? What's the driver? What's the motivation behind the connection?

>> Sure, so the number one driver for what we do, we want to stop the breach. And you stop the breach by having the right data set at the right time and being able to action the data in real time. So the LogScale product, instant search capability, long-term data retention, and it's quite affordable and efficient to do that, which everybody in this market is looking for the affordable and efficient button. But zooming out a little bit, I think what we hear from customers is a lot of pain points around legacy SIEM products. It's too expensive, it takes too many people to operate, getting data in, getting data out, too difficult. And frankly, that's a lot of the reasons why Cribl was created in the first place as well. There's got to be a better way. So I think we're going to see that whole SIEM market evolve in a very material way as XDR and SIEM really collide. And that creates a lot of opportunities for customers to have a more efficient way to do security and beyond, as well as a place to retain, store, manage, search, all these different things they want to do.

>> Keep an eye on the data. It's awesome. I want to talk about the partnership again before we go into some of the observability trends. One of the big discussions this event is the collaboration between companies, not just on sharing information but actually working together like this. Can you comment on how you see that evolving? We're going to see more of that? And what's the best practice on partnering?

>> So CrowdStrike, we're really on this EDR to XDR transformation. And what's nice about XDR is it's a team sport. We can't do it alone. It's not just about the attack surfaces that we protect at CrowdStrike, it's also about integrating with other third party products. And hundreds of companies work with CrowdStrike. We're really becoming an ecosystem within cybersecurity, so better together. I mean, when we all work together, our customers get a better cybersecurity outcome. That's faster security, that's more simple security. And it all starts and ends with the data. And if we don't bring in the data, they don't get the result, the benefit, and the ease of operation from all these different products.

>> John: More data, more scale.

>> You can't get to full XDR without all these additional data sources. And so when we talk about partnering, like we're all about choice. Customers should choose, where do they want their data to go? Which tools... All of the tools that end up in an environment were chosen for a reason. We want to give them the ability to have those. And then once they've made a choice, and they've said we're buying into this XDR journey, we want this ability to do this. Well, then the next step is how easy can we make that so that they don't have to replace fleets of agents on non-CrowdStrike devices-

>> And we've heard so many stories even on theCUBE from frustrated CISOs that are saying, "look, I'm buying these other tools, I've got a lot of retro coding going on. I got to rewrite code-

>> Daniel: Parsers.

>> Stuff breaks. I won't say 'cause we're PG 13 here on theCUBE today, unlike yesterday. (Abby laughs) So, okay, partnerships are cool. Somewhat observability is a hot category, continue to merge. It's been overfunded. We see some consolidation in this market but with more data coming in and more services being deployed, especially in cloud native and edge, there's more need for better observability. So what's the vision that you guys see? And certainly with AI and machine learning, more code will be generated so more code will be flooding into the networks. So who's going to watch that? Who's going to observe the observability and get the whole AI discussion? So we're anticipating that's going to change the game in observability. What's your angle on that?

>> So I think from a data perspective, as I mentioned, 250% more data in the next five years than you have today. And so you keep seeing this data growth but what do you do with it? Because a lot of data, especially the telemetry data that we're focused on, which is, how do we solve problems for the data that's coming from all these applications? You have a transaction online, you book a plane ticket or something. That looks like one transaction but behind the scenes, there's hundreds of things that folks are watching. How fast did that website respond? Did my services actually work? And you'll see all of this coming and it's just constantly growing. And so what Cribl does and what observability is about is saying that data, it may have near zero value until it is the most valuable data because something happened and you have to be able to get to it. So if you're going to stay in front of that, how do you figure out where are those nuggets of gold? What is actually valuable to you? And observability as a trend or as a market category is really about how do I ask questions of data that I didn't anticipate before because I didn't even know that data was going to be valuable until there was a problem?

>> Yeah, the data geeks, if they hoard the data, they keep it around or they build products. You've got to be proud of Cribl right now. It's pretty-

>> Abby: It's been amazing journey.

>> Daniel: It's revolutionary. But the destinations where people are putting their data, that's what's changing too. That's where having an XDR platform that can ingest it, that can sustain it, maintain it for years, that makes it instantly available, easy to search, affordable, you get a lot more value out of the data that Abby's talking about that you didn't need until that one moment when there was a suspicious event.

>> This team sport angle is interesting. I want to get your thoughts. You guys haven't had news lately. What's the update on the XDR? What's the latest in CrowdStrike? What's the momentum look like?

>> Sure. So lots of things going on at CrowdStrike. We have 23 modules on the platform that are doing things well beyond endpoint. So helping customers secure their cloud, helping customers secure identity, that's a really hot, fast growing space in the market. Also, the LogScale product that we're talking about, that XDR backend, very interesting. This week we just announced managed XDR, where it's a service wrapper that our partners deliver as well as we deliver for customers that want to operationalize and that use XDR that's integrating multiple other point products or other platforms into the CrowdStrike experience. So we're here really living and breathing this team sport, making it a reality. We're not just talking about it, we're doing it-

>> And the thing that you guys do. And the numbers obviously on the performance on the business side is great, but the industry, there's some fat that needs to be cut and we see some areas that need to be kind of, okay, move to the side, let's let it go to the next level. And I think the data piece is huge. Big endorsement with CrowdStrike. Again, great relationship. Congratulations on Cribl.

>> Abby: Thank you, super excited.

>> And say hello to the team over there, Clinton and everybody, so you know.

>> Yeah, will do. I know, we really enjoy our time on theCUBE.

>> You guys are awesome. And we'll see you at the event. What else is new at the company? The event coming up?

Put a plug in. >> We have Falcon coming up. That's where the security ecosystem, we're not just here at RSA, everybody's coming all over again and doing it at Falcon where we're becoming that defining event of security.

>> Yeah.

>> Hundreds of our tech ISV partners, our service provider partners, our MSP partners, and of course thousands of customers will be there too-

>> And we'll be there too.

We will be there. >> Awesome.

>> And on our journey to get to 26,000 customers also. We are also having our very first CriblCon this year, so it'll be in July in Las Vegas.

>> John: Okay, wow.

>> This will be the... We're hoping for hundreds.

>> Well, we love to go to original events, we've been to every DockerCon even virtual when they started, so maybe CriblCon could be a nice trend. "Present at creation," that's the big CUBE motto. When the first event comes out, you've got to keep us in mind, we'll come over.

>> We will talk after the show.

>> You've got to start at CriblCon then come to Falcon and then we'll see you at both places.

>> Good to have you. Thanks for coming on, I appreciate it. Okay, it's the news action here at RSA. This is where the game is changing, it's evolving. Security's getting, I would say not a mulligan, but they're taking it to the next level as super cloud, as super apps come out. More data, all happening here with CrowdStrike, here at theCUBE. Thanks for watching. We'll be right back after this short break. (upbeat music)