This week, Cribl announced it is acquiring CardinalOps, an agentic detection-engineering company, in a move that extends the firm beyond pipeline and routing into security operations. In the press release, Cribl positions itself as the AI Platform for Telemetry and frames the deal as adding detection capabilities that help customers improve threat coverage, lower data costs, and strengthen SOCs — creating a flexible path toward replacing legacy SIEM architectures. The architecture diagram Cribl uses is useful context: SIEM appears as one of several apps sitting above a shared lakehouse and federated search layer, rather than as a standalone product stack. We think that framing is the real story. CardinalOps contributes the detection layer — continuous gap hunting, cleanup of noisy or broken rules, and mapping of controls against adversary behavior — on top of capabilities Cribl already had in workflow, log handling, and search.
On Cribl’s model, SIEM is not a separate walled garden. It is an application that sits on the company’s data lake / lakehouse and is ultimately built on Search, with pipeline ingest, direct-to-lake paths, and multiple data stores underneath. Cribl’s telemetry system has been used for security systems now for many years. CardinalOps adds the missing detection piece to existing workflow and log-engine functions, so customers can keep vendor-agnostic telemetry infrastructure they already own instead of buying another closed SIEM. Cribl’s language now centers on storage and analytics for both humans and agents — not only moving and shaping data. That is a deliberate shift from “pipeline company” to platform company: collect, store, search, and act on telemetry, with SIEM as one app among others rather than the center of the architecture.
With Black Hat USA approaching in Las Vegas (August 1–6, 2026) and CriblCon 26 scheduled for Chicago in late September (September 28–30), the company is likely to have held additional product detail for the conference cycle. The CardinalOps close gives Cribl a clearer security-operations story heading into those events; we expect further platform and applications-related announcements as the firm fills out the app layer on its telemetry foundation. 650 Group researches several of the technologies covered in this blog, including Security and SASE, Enterprise, and more.