Cribl
Cribl is a privately held, San Francisco-based software company founded in 2018 that builds a vendor-neutral Data Engine (Stream, Edge, Lake, Search, Guard, Copilot, Insights) for collecting, routing, transforming, storing, and analyzing IT and security telemetry. It serves 50% of the Fortune 100, including financial services, healthcare, telecom, and public-sector enterprises, monetizing through freemium, consumption-based Cribl Credits, and Enterprise capacity commitments.
- Company typePrivate
- Founded2018
- HeadquartersSan Francisco, United States
- Headcount501–1,000
- GTM typeB2B
- OfferingSoftware
What Cribl does
Cribl is a privately held, San Francisco-headquartered software company founded in 2018 that builds the "AI Platform for Telemetry" — a vendor-neutral Data Engine that ingests, routes, transforms, stores, searches, and protects observability and security telemetry across hybrid and multi-cloud environments. Its core products include Cribl Stream (telemetry pipeline and router), Cribl Edge (lightweight collection agent supporting Linux, Windows, Kubernetes, and macOS), Cribl Lake and Cribl Lakehouse (object-storage data lake with federated query), Cribl Search (federated in-place search with pre-built Search Packs for AWS WAF, CrowdStrike, Palo Alto, Corelight, and others), Cribl Guard (AI-powered sensitive data detection and masking), Cribl Copilot/Copilot Editor (AI-assisted schema mapping and pipeline building), and Cribl Insights (monitoring, alerting, and LLM-cost analytics across 16 models). Architecture is positioned around an "Agentic Telemetry" paradigm with a Model Context Protocol (MCP) server designed to handle the 10x query volumes that AI agents generate against telemetry data.
Cribl monetizes through a hybrid model combining a free Cribl.Cloud tier (up to 1TB/day) and free self-hosted Stream/Edge downloads as a product-led top-of-funnel, with paid conversion into Cribl Credits consumption, Enterprise capacity commitments, and Silver/Gold/Platinum Activation Services. Distribution is multi-channel: direct enterprise field sales led by CRO Mike Pyle (ex-GitLab), self-serve PLG (Sandbox, Cloud Trial, free downloads), cloud marketplace listings on AWS, Azure, and GCP via Tackle.io, and a partner program with Service Delivery Partners and Technology Alliance Partners (including Accenture). The customer base spans 50% of the Fortune 100, 25% of the Fortune 500, six of the top 10 U.S. banks, and named enterprises such as ServiceNow (deployed across ~55,000 servers), Nutanix, Siemens, Vodafone, Yale New Haven Health, and FINRA.
The company has raised over $400M cumulatively across a $200M Series C (Aug 2021, Greylock and Redpoint), a $150M Series D (May 2022, Tiger Global), and a $319M Series E (Aug 2024, GV-led at a $3.5B valuation), reaching $300M in ARR by February 2026. Cribl holds 11 granted U.S. patents and reports 130%+ net dollar retention with 200% YoY growth in multi-product customers. As of early 2026, the company remained private while trade press reported consideration of a secondary offering and positioning for an IPO.
Cribl firmographics
Firmographics- Name
- Cribl
- Legal name
- Cribl, Inc.
- Website
- https://cribl.io
- Company type
- Private
- Founded year
- 2018
- Operating status
- Operating
- Headcount range
- 501–1,000 employees
- Short description
- Cribl is a privately held, San Francisco-based software company founded in 2018 that builds a vendor-neutral Data Engine (Stream, Edge, Lake, Search, Guard, Copilot, Insights) for collecting, routing, transforming, storing, and analyzing IT and security telemetry. It serves 50% of the Fortune 100, including financial services, healthcare, telecom, and public-sector enterprises, monetizing through freemium, consumption-based Cribl Credits, and Enterprise capacity commitments.
- Ownership category
- akta.pro rank
Cribl industry classification
Industry- Product category
- Telemetry Data Pipeline / Observability Platform
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- CRM Data Quality, Enrichment & CDP-Adjacent CRM (HDAEAFAJ)
- akta.pro secondary industry
- B2B SaaS & Enterprise Personalization (CRM, Sales, Support) (HDAAAGAJ)
Keywords
Where Cribl is headquartered
LocationHeadquarters
- HQ city
- San Francisco
- HQ country
- United States
- HQ region
- North America
Offices2 records
Markets served
Cribl business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- Cribl Stream / Edge / Lake / Search subscriptions (Cribl Credits): Recurring subscription revenue via Cribl Credits purchased for use on Cloud Products; Cribl Credits roll over across renewals; Cloud Product Credits expire at end of agreement term.
- Capacity Commitment (Enterprise license): Enterprise tier sold as capacity commitments, with supplemental terms governing committed usage across Cloud Products.
- Usage-based consumption (free + paid tiers): Free tier of up to 1TB/day with no license; usage scales into paid subscriptions as customers exceed the free threshold, generating land-and-expand dynamics (e.g., Cribl noted a 200% YoY increase in multi-product customers).
- Freemium / Free tier: Cribl.Cloud free tier (up to 1TB/day) plus free Cribl Stream/Edge downloads with no license required — a top-of-funnel to drive paid conversion.
- Professional services (Activation Services): Silver, Gold, and Platinum Activation Services plus Cribl Search Activation, Cribl.Cloud Migration, and Deployment Health Check — sold as Service Packages or Service Credits.
- Marketplace transactions (AWS, Azure, GCP): Cloud marketplace transacting via Tackle.io on AWS Marketplace, Google Cloud Platform Marketplace, and Microsoft Azure Marketplace.
- Reseller / partner-driven sales: One-Time Reseller Agreement and Technology Alliance Partner Program enable resellers and partners to distribute Cribl Products.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Pay-as-you-go | Free tier — process up to 1TB/day on Cribl.Cloud, no license required |
| Hybrid | Annual | Enterprise capacity commitment (quote-based) |
| Usage-based | Multi-year contract | Cribl Credits (Cloud Products usage) |
| Other | Annual | Self-hosted Cribl Stream / Edge (free download + paid support) |
Go-to-market motion6 records
Distribution channels6 records
Marketing channels11 records
Cribl product offering
Product offeringCore offering
Cribl sells a vendor-neutral AI Platform for Telemetry, composed of Cribl Stream (data routing/transform pipeline), Cribl Edge (lightweight collection agent), Cribl Lake and Cribl Lakehouse (object-storage data lake), Cribl Search (federated in-place search), Cribl Guard (sensitive data protection), Cribl Copilot/AI, and Cribl Insights. The platform enables enterprises to collect, route, enrich, reduce, transform, store, replay, redact, and search observability and security telemetry data across any tool, format, or location without vendor lock-in.
Differentiator
Problem solved
Functional benefit
Brands
- Cribl Stream: Telemetry data pipeline and routing platform for collecting, routing, enriching, transforming, and reducing observability and security data.
- Cribl Edge
- Cribl Search
- Cribl Lakehouse
- Cribl.Cloud
- Cribl AI
Products and services
- Cribl Stream Vendor-neutral telemetry data pipeline that collects, routes, enriches, transforms, reduces, stores, replays, and redacts logs, metrics, and traces to any destination tool. Designed for security, observability, and IT teams in enterprises that need to control telemetry across hybrid and multi-cloud environments.
- Cribl Edge Lightweight unified data collection agent that supports Linux, Windows, Kubernetes, and macOS endpoints. Designed for IT, security, and observability teams needing low-overhead telemetry collection across distributed enterprise endpoints.
- Cribl Search Federated search-in-place analytics tool that queries any data, in any format, at any location without re-ingestion, with pre-built Search Packs for common security and observability sources. Designed for SOC analysts, SREs, and platform engineers that need to investigate across distributed telemetry stores.
- Cribl Lakehouse Next-generation architecture for managing IT and security telemetry data at scale, with elastic scalability, federated query capabilities, and up to 50% cost reduction versus traditional lake solutions. Designed for enterprises storing and analyzing large volumes of telemetry data.
- Cribl.Cloud Cloud-based SaaS delivery of the Cribl data engine (Stream, Edge, Lake/Lakehouse, Search, Guard, Insights) with a free tier of up to 1TB/day and a Government edition for federal agencies. Designed for enterprises that prefer managed cloud delivery of Cribl's telemetry platform.
- Cribl Guard AI-powered solution for real-time detection and protection of sensitive data in telemetry streams, with 200+ customizable rules and compliance support for GDPR, CCPA, and HIPAA. Designed for security and compliance teams that need to redact sensitive data in flight across their telemetry pipelines.
- Cribl Copilot (Cribl AI) AI-powered product (including Cribl Copilot Editor) for schema mapping, log translation, and pipeline construction, with human-in-the-loop controls. Designed for Cribl customers (platform engineers, SREs, and security engineers) building and operating telemetry pipelines.
- Cribl Insights
Quantifiable outcome
- ~50% reduction in firewall log volume (Nutanix)
- +6 more outcomes
Companies that use Cribl
Customer profileNamed customers22 records
Segments10 records
Ideal customer profiles3 records
Cribl technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration73 records
AI capability5 records
Feature13 records
Cribl partnerships and signals
Strategic signalPartnerships
23 partnerships are on record, tiered flagship, core and minor.
- AnthropicflagshipIntegration with Anthropic's Claude Compliance API enables security and compliance teams to gain visibility into Claude Enterprise usage directly within Cribl's platform. The integration extends existing DLP, monitoring, retention, and audit workflows to Claude.
- DatabricksflagshipCribl announced a Databricks Destination integration for Cribl Stream in December 2025 — preprocesses, shapes, and filters high-volume observability/security data before landing in Databricks with Unity Catalog alignment, audit telemetry, and credential validation.
- Chirantan "CJ" Desai (MongoDB CEO)coreAppointed to Cribl's Board of Directors on November 20, 2025. President and CEO of MongoDB, with prior leadership roles at Cloudflare and ServiceNow. His experience is expected to influence product strategy amid AI-driven data management challenges.
- MicrosoftflagshipExpanded collaboration with Microsoft in November 2025 with a new Cribl Stream integration into Microsoft Fabric Real-Time Intelligence. Available as a ready-to-use Data Source in Fabric. Also listed on Microsoft Azure Marketplace.
- Google (Cloud / Security Operations)flagshipIntegration between Cribl Stream and Google Chronicle Ingestion API (Google Security Operations) enables up to 4x higher throughput, per-event labeling, and 4 MB batches. Step-by-step technical guide published for configuration.
- DeepTempocoreStrategic partnership announced October 14, 2025 to deliver an integrated threat detection solution powered by deep learning. Combines DeepTempo's Tempo platform (featuring LogLM) with Cribl's data collection capabilities for real-time detection.
- ExabeamflagshipStrategic partnership extending behavioral detections and insider risk capabilities; Cribl, DataBahn, and Google named as Exabeam partners in 2025 Gartner SIEM Magic Quadrant leadership; Cribl is a named partner in the Exabeam New-Scale Platform.
- Palo Alto NetworksflagshipStrategic partnership announced April 28, 2025 to accelerate AI-driven SecOps; new Cribl integration with Cortex XSIAM enables faster data onboarding, simplified PoC assessments, and streamlined SOC transformation for customers migrating from legacy SIEMs.
- Gigamoncore"Power of 3" offering with Cribl and Blackwood announced December 2024 to deliver comprehensive intelligence to cloud, security, and observability tools.
- BlackwoodminorCo-partner with Cribl and Gigamon in the "Power of 3" offering for cloud, security, and observability intelligence.
- Amazon Web Services (AWS)flagshipCribl Cloud is hosted on AWS, Cribl Stream is available as a native Azure Cloud Service, and Cribl is listed on the AWS Marketplace. Cribl has a Security Lake compatibility integration and the AWS WAF Search Pack is a flagship integration.
- AnomalicoreStrategic partnership announced August 2024 to supercharge cybersecurity and significantly reduce enterprise costs; combines Anomali's threat intelligence with Cribl's data routing.
- Vijilan SecurityminorPartnership announced August 2024 to transform data management for IT and security, combining Vijilan's MSSP expertise with Cribl's data pipeline capabilities.
- CrowdStrikeflagshipCrowdStrike Falcon endpoint telemetry is a flagship Cribl Search Pack; Cribl and CrowdStrike named as expanded partners alongside Microsoft Azure, AWS, and Wiz in Cribl's $200M ARR announcement.
- SplunkflagshipFeatured integration technology partner; Cribl is named a Customers' Choice in the 2024 Gartner Peer Insights Event Stream Processing report; Hydrolix/Splunk tiered observability reference.
- WizflagshipWiz is a featured integration technology partner and is named alongside CrowdStrike, Microsoft Azure, and AWS in Cribl's $200M ARR growth announcement.
- ConfluentcoreConfluent Cloud is a featured integration technology partner.
- ElasticcoreElastic is a featured integration technology partner.
- Auth0 (Okta)coreAuth0 provides authentication services and processes Customer Personal Data related to Cribl.Cloud and Cribl's products, including Cribl Curious, support portal, Pack Dispensary, and partner portal.
- SalesforcecoreSalesforce provides customer management services and processes Customer Personal Data related to Cribl's business relationships and customer support activities; integrates with Outreach, PagerDuty.
- SnowflakecoreSnowflake provides data storage used for Cribl's analytics activities and processes Customer Personal Data related to Cribl's business relationships and customer support activities.
- Tackle.iocoreTackle.io collects and processes customer data through AWS Marketplace, Google Cloud Platform Marketplace, and Microsoft Azure Marketplace to transact purchases with Cribl through those marketplaces.
- Atlassian (Jira)coreAtlassian Jira hosts Cribl's issue-tracking system related to providing, supporting, managing, and improving Cribl's products and services.
Scale indicators19 records
Recent moves6 records
Expansion highlights6 records
Cribl competitors and assessment
Company assessmentDirect peers
- Splunk (Cisco): Splunk is the dominant SIEM and observability platform and Cribl's most direct competitor in log routing, transformation, and storage. Cisco's $28B acquisition of Splunk (2024) added platform-scale resources; Cribl positions itself as the vendor-neutral layer that decouples enterprises from Splunk's licensing economics, with flagship Splunk Search Packs.
- Datadog: Datadog is a leading cloud observability and security platform. Cribl competes by routing, shaping, and reducing data before it reaches Datadog, helping customers manage ingest costs — a key Cribl differentiator and a Datadog vulnerability.
- Elastic: Elastic provides search-based observability and security analytics. Cribl integrates with Elasticsearch as a destination and positions its federated in-place search (Cribl Search) as a lower-cost alternative to re-ingesting into Elastic for queries.
- Sumo Logic: Sumo Logic is a cloud-native log management and SIEM platform. Cribl Stream and Edge integrate with Sumo Logic as a destination, competing for the same observability/security log pipeline workloads.
- Dynatrace: Dynatrace is a unified observability and security platform. While Dynatrace leans into a single SaaS stack, Cribl competes by offering a vendor-neutral data engine that feeds multiple backends (including Dynatrace) while avoiding lock-in.
- New Relic: New Relic is a cloud observability platform that ingests logs, metrics, and traces. Cribl Stream routes and shapes data sent to New Relic, competing for budget allocation in observability pipelines.
- Confluent: Confluent (commercial Kafka) is a streaming data platform. Cribl integrates with Confluent Cloud as a featured technology partner, and the two compete for streaming-pipeline workloads in event stream processing — Gartner Peer Insights named Cribl a Customers' Choice in ESP alongside Splunk.
Broad incumbents
- Snowflake: Snowflake is a cloud data platform that increasingly absorbs observability/security workloads. Cribl uses Snowflake for internal analytics and integrates with it as a destination, but Snowflake's broader data-platform ambitions overlap with Cribl Lakehouse for telemetry storage and query.
Emerging players
- Grafana Labs: Grafana Labs (Loki, Tempo, Mimir, Grafana) is an open-source observability stack that competes on log/metric storage and visualization. Cribl integrates with Grafana as a destination and competes on the routing/reduction layer feeding it.
- Honeycomb: Honeycomb is an observability platform focused on high-cardinality event data. Cribl Stream delivers observability data to Honeycomb as a destination and competes for engineering-team budget on modern observability use cases.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
Cribl social profiles
Digital presenceCribl financial estimates
Financial estimateRevenue estimate
Valuation estimate
Cribl leadership team
Management profileNumber of profiles
Profiles16 records
Cribl funding detail
Funding detailFunding overview
Funding rounds8 records
Investors12 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Cribl M&A and investment
M&A and investmentM&A2 records
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Cribl
What does Cribl do?
Cribl sells a vendor-neutral AI Platform for Telemetry, composed of Cribl Stream (data routing/transform pipeline), Cribl Edge (lightweight collection agent), Cribl Lake and Cribl Lakehouse (object-storage data lake), Cribl Search (federated in-place search), Cribl Guard (sensitive data protection), Cribl Copilot/AI, and Cribl Insights. The platform enables enterprises to collect, route, enrich, reduce, transform, store, replay, redact, and search observability and security telemetry data across any tool, format, or location without vendor lock-in.
Is Cribl a public or private company?
Cribl is a private company. It is classified as venture growth investor backed and is currently operating.
When was Cribl founded?
Cribl was founded in 2018. It employs 501 to 1,000 people.
Where is Cribl based?
Cribl is headquartered in San Francisco, United States, in the North America region.
How does Cribl make money?
Seven revenue lines are on record. Cribl Stream / Edge / Lake / Search subscriptions (Cribl Credits) is the primary driver. The others are capacity Commitment (Enterprise license), usage-based consumption (free + paid tiers), freemium / Free tier, professional services (Activation Services), marketplace transactions (AWS, Azure, GCP) and reseller / partner-driven sales.
Who are Cribl's main competitors?
Direct peers on record are Splunk (Cisco), Datadog, Elastic, Sumo Logic, Dynatrace, New Relic and Confluent. Snowflake is listed as a broad incumbent. Emerging players are Grafana Labs and Honeycomb.
Does Cribl have an API?
Yes. Cribl offers a public API enabling DevOps automation of telemetry pipeline management via 'Cribl as Code,' using REST APIs, Terraform, and SDKs. Cribl also ships a Model Context Protocol (MCP) server, announced as part of its agentic AI roadmap, enabling third-party agents to operate securely on its platform. Cribl Stream exposes REST APIs used by Cribl Packs, Output Routers, and integration configurations. API documentation is hosted at docs.cribl.io. Developer documentation is at docs.cribl.io.
What industry is Cribl in?
Cribl's product category is Telemetry Data Pipeline / Observability Platform. Its primary akta.pro industry code is HDAEAFAJ, CRM Data Quality, Enrichment & CDP-Adjacent CRM, with a secondary code of HDAAAGAJ, B2B SaaS & Enterprise Personalization (CRM, Sales, Support). Its SIC code is 7372.