Cribl helps Pitt migrate to Microsoft Sentinel, save $800K annually

The University of Pittsburgh is a large public research university with more than 34,000 enrolled students, 5,900 faculty, and 8,900 staff. With its large research footprint and four regional campuses, Pitt's digital security scope is massive, including over 110,000 unique devices, 2,100 servers, 206,000 cloud resources, and 1.2 million email messages received daily.

The university sought to optimize its management of unstructured security data, with most logs lacking consistent format for searchability. This inefficiency slowed incident investigation and response and, combined with a daily ingest of 4TB of data, led to significant costs for Pitt to maintain its security information and event management (SIEM) system.

Cribl facilitates seamless migration to Microsoft Sentinel

Initially, the university's security data did not meet the formatting requirements for a strategic transition to Microsoft Sentinel. Pitt implemented a combination of Cribl Stream and Cribl Edge, part of Cribl.Cloud in Microsoft Marketplace, to move the data from the old SIEM to Microsoft Sentinel.

Founded in 2018 in San Francisco, California, Microsoft partner Cribl empowers enterprises to manage and analyze telemetry for both humans and agents, bridging the gap between AI ambition and infrastructure reality. Cribl’s vendor-agnostic AI platform cost-effectively handles increasing data volume and variety without delay, giving enterprises the choice, control, and flexibility to build what’s next.

“Our partnership with Microsoft combines Cribl’s in-flight data shaping with Microsoft Sentinel’s robust capabilities,” said Kam Amir, Director of Technical Alliances, Cribl. “This integrated solution enables customers like the University of Pittsburgh to achieve cost-effective SIEM migration and gain immediate, actionable security insights.”

Pitt used Cribl Stream to establish pre-processing pipelines for parsing, normalizing, and enriching logs in real time, readying the data for immediate ingestion by Microsoft Sentinel. Cribl Edge was deployed across more than 1,000 servers to act as a simplified agent replacement, reducing the volume of data via filtering and compressing.

“Compared to our previous setup, Cribl has significantly improved our security data management, making operations smoother,” said Richard McIver, Senior Security Engineer, University of Pittsburgh. “For a team managing security at Pitt’s scale, Cribl has been an invaluable asset.”

$800K in annual savings and a SIEM migration in just 68 days

The University of Pittsburgh used Cribl to filter, compress, and eliminate unnecessary fields from its security data, completing a full SIEM migration to Microsoft Sentinel in just 68 days. Together, Cribl Stream and Cribl Edge delivered a 37 percent overall reduction in data ingest and an estimated $800,000 in annual savings. The Pitt security team is now leveraging over 200 built-in analytics rules in Microsoft Sentinel and managing over 1,000 centralized Cribl Edge agents.

The university achieved a major benefit of optimized ingestion costs and controlled long-term SIEM costs. Cribl’s centralized control, intuitive interface, and unified platform streamlined administration, making data management and operations smoother and more efficient for the IT security team.