(upbeat music)
>> Hey, welcome back everyone,
to theCUBE's live coverage
of RSA Conference 2023 in Moscone.
I'm John Furrier, host of theCUBE day two.
Kind of feels like day one.
Day one was yesterday but this is day two, full program.
It's packed.
Events are back.
Steady state. We've got two great guests here.
Abby Strong is the Senior Vice President
of Customer Experience at Cribl.
Thanks for coming on.
>> Yeah, thank you.
>> Congratulations.
And Daniel Bernard, Chief Business Officer at CrowdStrike.
Good to see you guys.
>> John, good to be here. >> Thanks for coming on.
>> Yeah, super excited. >> So, Cribl, CrowdStrike,
partnership.
We've got some news. Let's get that out of the gate.
Let's hear the news.
>> Let's do it. >> Sure.
Well, what's going on in the market
is a lot of our customers, they're on this XDR journey.
How do I bring data into the platform?
How do I use CrowdStrike for everything?
Not just security use cases, DevOps use cases as well.
And bringing data in with Cribl
just is so much easier, so much faster.
Bringing data in was a big struggle.
We've been working with Cribl a long time.
They're a Falcon Fund company.
Made an investment in them about a year and a half ago,
and they've really emerged as a leader in the market
in terms of this data transit.
And bringing data in with with Cribl
via our Falcon, our CrowdStream product,
it's never been easier, it's never been faster
and it's fully integrated.
>> Yeah, super excited.
We've just been working together a long time,
as he mentioned,
really helping CrowdStrike EDR customers
get their data into legacy SIEMs.
And now with CrowdStream, we have a much easier way
to get data into the CrowdStrike Falcon platform.
>> What I love about the news is that this is an example
of where this market is right now.
You have the explosion of new approaches
and demand for the data.
And it's got to be scalable and extensible
and reliable and easy to use.
And this is like, now the new table stakes
and the pressure's on.
So you guys bring that new product to the table.
What made this work?
What was the reason?
Were you guys partnering?
Can you expand on the relationship?
>> Sure.
I think some of the best partnerships,
they actually start organically.
And so if you look at the way data is moving
and where it was moving,
Falcon platform, EDR data, very voluminous data.
70% of the data that we'd see in legacy SIEM products
was coming from CrowdStrike.
How was it getting to these SIEM products?
It was going via Cribl.
So it was really easy for us to listen to our customers
and see this demand for the Cribl technology.
The differentiation and this observability pipeline
and for us to help route that right here
into the data destination,
which is our LogScale product in the Falcon XDR platform.
>> Yeah, we share a lot of customers in common already.
And it was interesting seeing that grow from the field
and then even as they were starting to look at LogScale
and the opportunity that they have with that product.
And to hear them go,
"well, can you help us move data into this product?"
And so we built a pack,
made it really easy to move data over.
And of course, that turned into,
well, how do we get that inside the CrowdStrike interface
to make it even easier for customers to-
>> Take us through how it works because this is a big deal.
And I think,
again, I've talked to the founders at Cribl
many times when they started.
They just build product and then they...
What's your go to...
We just go to customers,
they've got a problem, we just build it for them,
next thing they're working together.
And now you've got data as large scale,
the plumbing's there.
Talk about how it works with CrowdStrike
so people can understand the connections.
>> Sure.
So it starts like this,
and we're going to do it live
so you see what the customer experience is.
You log into our platform,
there's a button, it says CrowdStream powered by Cribl.
You click the button
and that starts your data journey of bringing the data in.
That's where Cribl comes into play.
>> Yeah.
And so customers can choose,
we have a very easy and intuitive interface
with a thousand integrations
for all the different source types that they might have.
And it allows for customers just to immediately go,
"Which sources am I interested in moving
into the Falcon LogScale platform?"
And then just literally drag and drop
and say, "send it to LogScale now."
And we'll automatically process, parse it, forward it
and then format it in the right way so we can land it there.
>> That's so easy.
We're done.
I mean, okay. (Abby laughing)
Okay, that's a wrap guys.
No, I mean that's kind of the way it's supposed to be.
Okay, what's the impact to customers?
Are you guys going to go to market together?
Talk about the relationships.
>> Sure. >> What's the plan?
>> We're going to market together,
but what makes this really, really wonderful
for our customers, we've got over 26,000 customers,
and great for Cribl, is we make it so easy.
Like you said, what's the big barrier to XDR?
The big barrier to XDR is,
okay, you've got the CrowdStrike data,
that's endpoint, that's cloud,
that's workload, that's identity.
>> John: Explain XDR real quick before-
>> Sure.
So XDR, it really starts with where we were with EDR,
endpoint detection and response.
And CrowdStrike pioneered, created, owns the EDR category.
Endpoint, you want to do prevention, detection and response.
So the D and the R is detection and response.
How do you keep an endpoint safe today?
That's EDR.
Enterprises are sitting there saying,
"Wait, we want to do it beyond the endpoint.
We want this protection layer,
this visibility layer across everything."
And that's where we start getting into data
and attack surfaces that aren't CrowdStrike.
And that's where the X comes in.
Extended detection and response.
So if you're trying to move to XDR,
it really becomes more of a data based,
a data defined problem.
How do you get the visibility over the data?
How do you bring it to one place?
And we are the one place.
And in order to be the one place
we need to make data in really, really easy.
>> Well, first of all,
I want to say congratulations to CrowdStrike.
We follow a lot of the public stock metrics.
Dave does.
Like you read about it, Dave's much more on that,
but the metrics are all doing great on the business side.
So congratulations.
This, working with other companies
has become a connection business,
where API is in the cloud,
data connects to data,
people are working together,
clean rooms are being discussed everywhere you talk about.
So this is like a connector on steroids, seems like.
Is that kind- >> A little bit.
I mean, at the heart of it,
Cribl is an integrations company.
And so what we spend our time and attention
is on where is all of the data?
And then how do we get it to the various destinations?
And in this case, specifically LogScale.
But really, we were formed
to help customers overcome this problem.
Data is growing at a 25% CAGR.
That means in five years
you're going to have 250% more data than you have today-
>> That might be understated, by the way.
>> And a lot of it is coming from EDR,
if we're being quite honest,
as you said, 60 to 70%.
And so how do you get in front of that,
make sure that you can put it where it needs to go?
And then once you have that as the gravity
that comes with that amount of data,
how do you get your other data in there?
Where's your firewall data?
Where are inputs from other parts of the business
that you can use to solve problems?
>> It's like filling up the gas tank,
you just go pump it in.
So what's the use case?
What's the driver here?
More visibility?
Is it more data
for all those solutions you guys are driving?
Is the customers saying I have bespoke data?
Is they have a tool?
Are they replacing something?
What's the driver?
What's the motivation behind the connection?
>> Sure, so the number one driver for what we do,
we want to stop the breach.
And you stop the breach
by having the right data set at the right time
and being able to action the data in real time.
So the LogScale product, instant search capability,
long-term data retention,
and it's quite affordable and efficient to do that,
which everybody in this market
is looking for the affordable and efficient button.
But zooming out a little bit,
I think what we hear from customers
is a lot of pain points around legacy SIEM products.
It's too expensive,
it takes too many people to operate,
getting data in, getting data out, too difficult.
And frankly, that's a lot of the reasons
why Cribl was created in the first place as well.
There's got to be a better way.
So I think we're going to see that whole SIEM market evolve
in a very material way
as XDR and SIEM really collide.
And that creates a lot of opportunities
for customers to have a more efficient way
to do security and beyond,
as well as a place to retain, store, manage, search,
all these different things they want to do.
>> Keep an eye on the data. It's awesome.
I want to talk about the partnership again
before we go into some of the observability trends.
One of the big discussions this event
is the collaboration between companies,
not just on sharing information
but actually working together like this.
Can you comment on how you see that evolving?
We're going to see more of that?
And what's the best practice on partnering?
>> So CrowdStrike,
we're really on this EDR to XDR transformation.
And what's nice about XDR is it's a team sport.
We can't do it alone.
It's not just about the attack surfaces
that we protect at CrowdStrike,
it's also about integrating with other third party products.
And hundreds of companies work with CrowdStrike.
We're really becoming an ecosystem within cybersecurity,
so better together.
I mean, when we all work together,
our customers get a better cybersecurity outcome.
That's faster security, that's more simple security.
And it all starts and ends with the data.
And if we don't bring in the data,
they don't get the result, the benefit,
and the ease of operation from all these different products.
>> John: More data, more scale.
>> You can't get to full XDR
without all these additional data sources.
And so when we talk about partnering,
like we're all about choice.
Customers should choose,
where do they want their data to go?
Which tools...
All of the tools that end up in an environment
were chosen for a reason.
We want to give them the ability to have those.
And then once they've made a choice,
and they've said we're buying into this XDR journey,
we want this ability to do this.
Well, then the next step is how easy can we make that
so that they don't have to replace fleets of agents
on non-CrowdStrike devices-
>> And we've heard so many stories even on theCUBE
from frustrated CISOs that are saying,
"look, I'm buying these other tools,
I've got a lot of retro coding going on.
I got to rewrite code-
>> Daniel: Parsers.
>> Stuff breaks.
I won't say 'cause we're PG 13 here on theCUBE today,
unlike yesterday.
(Abby laughs)
So, okay, partnerships are cool.
Somewhat observability is a hot category, continue to merge.
It's been overfunded.
We see some consolidation in this market
but with more data coming in
and more services being deployed,
especially in cloud native and edge,
there's more need for better observability.
So what's the vision that you guys see?
And certainly with AI and machine learning,
more code will be generated
so more code will be flooding into the networks.
So who's going to watch that?
Who's going to observe the observability
and get the whole AI discussion?
So we're anticipating
that's going to change the game in observability.
What's your angle on that?
>> So I think from a data perspective,
as I mentioned, 250% more data in the next five years
than you have today.
And so you keep seeing this data growth
but what do you do with it? Because a lot of data,
especially the telemetry data that we're focused on,
which is, how do we solve problems
for the data that's coming from all these applications?
You have a transaction online,
you book a plane ticket or something.
That looks like one transaction
but behind the scenes,
there's hundreds of things that folks are watching.
How fast did that website respond?
Did my services actually work?
And you'll see all of this coming
and it's just constantly growing.
And so what Cribl does and what observability is about
is saying that data, it may have near zero value
until it is the most valuable data
because something happened
and you have to be able to get to it.
So if you're going to stay in front of that,
how do you figure out where are those nuggets of gold?
What is actually valuable to you?
And observability as a trend or as a market category
is really about how do I ask questions of data
that I didn't anticipate before
because I didn't even know that data was going to be valuable
until there was a problem?
>> Yeah, the data geeks, if they hoard the data,
they keep it around or they build products.
You've got to be proud of Cribl right now.
It's pretty-
>> Abby: It's been amazing journey.
>> Daniel: It's revolutionary.
But the destinations where people are putting their data,
that's what's changing too.
That's where having an XDR platform
that can ingest it, that can sustain it,
maintain it for years,
that makes it instantly available,
easy to search, affordable,
you get a lot more value out of the data
that Abby's talking about
that you didn't need
until that one moment when there was a suspicious event.
>> This team sport angle is interesting.
I want to get your thoughts.
You guys haven't had news lately.
What's the update on the XDR?
What's the latest in CrowdStrike?
What's the momentum look like?
>> Sure.
So lots of things going on at CrowdStrike.
We have 23 modules on the platform
that are doing things well beyond endpoint.
So helping customers secure their cloud,
helping customers secure identity,
that's a really hot, fast growing space in the market.
Also, the LogScale product that we're talking about,
that XDR backend, very interesting.
This week we just announced managed XDR,
where it's a service wrapper that our partners deliver
as well as we deliver
for customers that want to operationalize and that use XDR
that's integrating multiple other point products
or other platforms into the CrowdStrike experience.
So we're here really living and breathing this team sport,
making it a reality.
We're not just talking about it, we're doing it-
>> And the thing that you guys do.
And the numbers obviously on the performance
on the business side is great,
but the industry, there's some fat that needs to be cut
and we see some areas
that need to be kind of, okay, move to the side,
let's let it go to the next level.
And I think the data piece is huge.
Big endorsement with CrowdStrike.
Again, great relationship.
Congratulations on Cribl.
>> Abby: Thank you, super excited.
>> And say hello to the team over there,
Clinton and everybody, so you know.
>> Yeah, will do.
I know, we really enjoy our time on theCUBE.
>> You guys are awesome.
And we'll see you at the event.
What else is new at the company?
The event coming up?
Put a plug in. >> We have Falcon coming up.
That's where the security ecosystem,
we're not just here at RSA,
everybody's coming all over again and doing it at Falcon
where we're becoming that defining event of security.
>> Yeah.
>> Hundreds of our tech ISV partners,
our service provider partners, our MSP partners,
and of course thousands of customers will be there too-
>> And we'll be there too.
We will be there. >> Awesome.
>> And on our journey to get to 26,000 customers also.
We are also having our very first CriblCon this year,
so it'll be in July in Las Vegas.
>> John: Okay, wow.
>> This will be the...
We're hoping for hundreds.
>> Well, we love to go to original events,
we've been to every DockerCon
even virtual when they started,
so maybe CriblCon could be a nice trend.
"Present at creation," that's the big CUBE motto.
When the first event comes out,
you've got to keep us in mind, we'll come over.
>> We will talk after the show.
>> You've got to start at CriblCon then come to Falcon
and then we'll see you at both places.
>> Good to have you.
Thanks for coming on, I appreciate it.
Okay, it's the news action here at RSA.
This is where the game is changing, it's evolving.
Security's getting, I would say not a mulligan,
but they're taking it to the next level
as super cloud, as super apps come out.
More data, all happening here with CrowdStrike,
here at theCUBE.
Thanks for watching.
We'll be right back after this short break.
(upbeat music)