On This Page

Home / Stream/ Integrations/ Destinations/AlphaSOC Destination

AlphaSOC Destination ​

AlphaSOC is a threat detection platform that ingests, normalizes, and analyzes security telemetry from cloud, application, network, and endpoint sources. It receives this telemetry through an S3-compatible API and runs it through its threat detection engine. The AlphaSOC Destination sends data to an AlphaSOC bucket using that S3-compatible API. For more information, see the AlphaSOC documentation.

Type: Non-Streaming | TLS Support: Yes | PQ Support: No

Configure Cribl Stream to Output to AlphaSOC ​

In Cribl Stream, configure the AlphaSOC Destination:

  1. On the top bar, select Products, and then select Cribl Stream. Under Worker Groups, select a Worker Group. Next, you have two options:
    • To configure via QuickConnect, navigate to Routing > QuickConnect. Select Add Destination and select the Destination you want from the list, choosing either Select Existing or Add New.
    • To configure via the Routes, select Data > Destinations. Select the Destination you want. Next, select Add Destination.
  2. In the New Destination modal, configure the following under General Settings:
    • Output ID: Enter a unique name to identify this AlphaSOC definition. If you clone this Destination, Cribl Stream will add -CLONE to the original Output ID.
    • Description: Optionally, enter a description.
    • AlphaSOC bucket name: JavaScript expression that resolves to the Destination AlphaSOC bucket name. The expression must evaluate to a string and is evaluated only once, when the Destination initializes. For a fixed bucket name, enter a quoted string such as 'events'. For a name derived from a global variable, use a JavaScript string expression such as myBucket-${C.vars.myVar}.

      Event-level variables are not available for this field, because the bucket name is evaluated only at Destination initialization. If you want to use event-level variables in file paths, we recommend specifying them in the Partitioning expression field in Optional Settings, because the Partitioning expression is evaluated for each file. For general expression syntax and examples, see Cribl Expression Syntax.

    • Staging location: Filesystem location in which to locally buffer files before compressing and moving to final destination. We recommend that this location be stable and high-performance.

      The Staging location field is not displayed or available on Cribl-managed Worker Groups in Cribl.Cloud.

    • Data format: The output data format defaults to