Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Google Chronicle > Cribl Admin CCOE > Flashcards

Cribl Admin CCOE Flashcards

1
Q

Which of the following is a valid JavaScript method?

A

.startswith
.endswith
.match

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following logical operator are used as an “and” operator?

A

&&

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Value Expressions can be used in the following locations

A

Capture Screen and Routes Filtering Screen
Routes Filtering Screen and Pipeline Filtering
Pipeline Filtering and Capture Screen
None of the above! is the correct answer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Value Expressions are used to evaluate true or false.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following logical operator are used as an “not” operator?

A

!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Git

What command shows you the files that have changed, been added, or are tracked?

A

Status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What order must you use to add a new file to a remote repository?

A

add, commit, push

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which command allows you to see a history or commits?

A

git log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Which command allows you to add a file to the respository?

A

add

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Worker Process

A

A process within a Single Instance, or within Worker Nodes, that handles data inputs, processing, and output. Worker Processess operate in parallel. Each Worker Process will maintain and manage its own outputs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Worker Node

A

An instance running as a managed worker, whose configuration is fully managed by the Leader Node

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Worker Group

A

A collection of Worker Nodes that share the same configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Leader Node

A

an instance running in Leader mode, used to centrally author configurations, and monitor a distributed deployment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Mapping Ruleset

A

an ordered list of Filters, used to map Workers to Worker Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which of the following is not a Worker responsibility?

A

Back up to Git (local only)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following is not an advantage of a Distributed deployment over a single instance?

A

Advanced data processing capabilities
Advantages include - Higher reliability, unlimited scalability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Load Balancing among the Worker Processes is done the following way:

A

The first connection will go to a random Worker Process, and the remaining connection will go in increasing order to the following Worker Processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

All Cribl Stream deployments are based on a shared-nothing architecture pattern, where instances/Nodes and their Worker Processes operate separately

A

True!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The Single Stream instance is valid for dev, QA or testing environments

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

In Distributed Mode, the Worker Node…

A

is Stateless
Can continue running even without communication to the Leader with limitations
Can be accessed from inside the Leader
The main path between Sources and Destinations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which of the following is true regarding Worker and Leader communication?

A

Worker initiates the communication between Leader and Workers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Worker processes within a Node are distributed using a round robin process based on connections

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which of the following are valid Stream deployment options?

A

Single Instance (software loaded on single host)
Distributed Deployment (Leader and Workers)
Stream deployed in Cribl’s cloud (SaaS)
Stream deployed in customers own cloud instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Worker Group to Worker Group communication is best done by using…

A

Stream TCP
and
Stream HTTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Cribl.Cloud advantages

A

Simplified administration
Simplified distributed architecture
Git preconfigured
Automatic restarts and upgrades
Simplified access management and security
Transparent licensing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Cribl.Cloud does not provide TLS encryptionon any Sources

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Cribl.Cloud allows for Stream to Stream communication from Cloud Worker Groups to on-prem Worker Groups

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Cribl.Cloud allows for restricted access to certain IP adresses

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

When using Stream in Cribl.Cloud, how do you get data into the cloud?

A

Using common data sources that are pre-configured (TCP, Splunk, Elastic, etc)
Using ports 200000-200100 that are available to receive data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Cribl.Cloud has preconfigured ports you can use to bring in data

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which of the following is not valid for a Cribl.Cloud deployment?

A

Single Stream instance
Distributed Stream instance with Leader on-prem & workers in the Cribl.Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which of the following are benefits when using Cribl.Cloud?

A

Simplified administration
Git preconfigured
Automatic upgrades

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Cribl.Cloud cannot integratte with an on-prem Cribl Worker Group

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Cribl.Cloud allowed ports include

A

20000-20010

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Cribl.Cloud does not provide any predefined sources

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What affects performance/sizing?

A

Event Breaker Rulesets
Number of Routes
Number of Pipelines
Number of Clones
Health of Destinations
Persistent Queueing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Estimating Deployment Requirements

A

Allocate 1 physical core for each 400GB/day of IN & OUT throughput
100GB in -> 100GB out to 3 destinations=400GB total. 400GB/400GB=1 physical core

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which of the following will impact your choice for amount of RAM?

A

Persistent Queueing requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Cribl Worker Process default memory is

A

2GB RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

How many Worker Nodes, each with 16vCPU is needed to Ingest 10TB and Send out 20TB?

A

11 Worker Nodes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Cribl recommends you use the following specifications?

A

16vCPU per Worker Node

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How can a Stream deployment be scaled to support high data and processing loads?

A

Scale up with higher system performance (CPU, Ram, Disk) on a single platform
Scale out with additional platforms
Add more worker groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

With a very large # of sources (UFs), it is possible to exhaust the available TCP ports on a single platform

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Leaders require higher system requirements than workers

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Persistent Queueing (Source & Destination) might impact performance

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Cribl scales best using…

A

Many medium size Worker nodes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Remote Repository Recovery - Overview

A
  1. System Down
  2. Install Git on Backup Node
  3. Recover configuration from remote repository
  4. Restart Leader Node
  5. Back Operational :)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Setting up and Connecting to Git Hub

A
  1. Set up GitHub
  2. Create an empty crypto repository
  3. Generate keys to connect Stream to GitHub (Public key>GitHub/Private Key>Stream)
  4. Configure Stream UI to connect to Remote Git
  5. Once connected, each time a change is made to local to sync with the remote repository
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

When using this commandto generate SSH Public and Private keys: ssh-keygen -ted25519 -C “your_email@example.com”, which file contains the public key

A

id_ed25519.pub

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

A remote repository on GitHub is a mandatory requirement when installing Cribl Stream

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

A Remote Git instances is

A

Optional for all Stream Deployments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What are the methods to backup Cribl Leader Node?

A

Rsync
Tar / untar
Copy configuration files to S3, rehydrate configuration files from S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Git and Git Hub provides backup and rollback of Cribl Stream configurations

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Cribl Stream fault tolerance requires the use of a remote Git repository

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is a true statement about GitHub acounts?

A

Requires manual configuration outside of Cribl Stream configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Stream disaster recovery requires a dedicated standby backup Leader

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Which Git commands are part of the recovery steps?

A

Git init
Git fetch origin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is the purpose of using Git?

A

To provide a backup of configuration files
To provide a history of changes within Stream

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

./cribl help -a

A

Displays a list of all the available commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Common Cribl Stream commands

A

./cribl start
./cribl stop
./cribl restart
./cribl status (shows Stream status)
./cribl diag (manages diagnostic bundles)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Cribl Stream CLI

A

CLI gives you the ability to run commands without needed access to the GUI
Helps in creating automated scripts if needed
Gives you the ability to run diagnostics and send them to Cribl Support

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What command is used to configure Cribl Stream to start at boot time?

A

boot-start

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What format are the diag files in?

A

.tar.gz

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What does the command ‘cribl diag’ create command do?

A

Creates a gzip file with configuration information and system state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What command is used to configure Cribl Stream as a leader?

A

./cribl mode-master

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

Once you run ‘cribl boot-start enable -m systemd’, you will need to use what command to start/stop Stream?

A

systemctl start cribl

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

The configuration files created with the diag command are in .js format?

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

You cannot export packs using the command line

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What types of files are in the diagnostic file?

A

Files in the local directory
Log files
State of the system
Details about the system running Stream

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

You can use the ‘mode’ command to configure a Cribl Stream instance into a Cribl Edge Node?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

You cannot install Packs using the CLI

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

Troubleshooting Source Issues

What is the status of the source?

A

Sources will have a red status on Leader until they are deployed to a worker group. Status can still be red if there are binding issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

Troubleshooting Source Issues

If you do a live cpature on the Source, are there any events?

A

Make sure JavaScript filter set for the live capture is correct. If no data is returned, the problem is likely with the network or further upstream

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

Troubleshooting Source Issues

Is the Source operational/reachable?

A

Ping the server?
Using nc or telnet command, test the connection source

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

Troubleshooting Source Issues

Is the Destination triggering backpressure?

A

Check by going to the Destination in Monitoring>Destinations and clicking on Status.
If the Source is connected via a Route to a Destination that is triggering backpressure, set to Block to stop sending data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

Troubleshooting Source Issues

Check Source config

A

Typos? Proper authentication?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

Stream Sources

Summary

A

Stream can accept data pushed to it, or pull data via API calls
Open protocols, as well as select proprietary products, are supported
Pulling data falls into two categories
* Scheduled pulls for recurring data (think tailing a file)
* Collector jobs intended for ad hoc runs as in Replay scenario
Push Sources push to us such as Splunk, TCP
Internal sources are internal to us such as Datagens or Internal logs/metrics
Low-code interface eases management
Capture sample data at any stage to validate and test

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

Stream Syslog Sources

Stream Syslog Sources Summary

A

Stream can process a syslog stream directly
Moving to Cribl Stream from existing syslog-ng or rsyslog servers fully replaces those solutions with one that is fully supported and easily managed
Optimze syslog events
Syslog data is best collected closest to the source
Use a load balancer to distribute load across multiple worker nodes
Reduce management conplexity while ensuring reliable and secure delivery of Syslog data to chosen systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

Configuring Elastic Beats

A

Beats are open-source data shippers that act as agents. Most popular with Cribl customers:
Filebeat - filebeat.yml
Winlogbeat - Winlogbeat.yml

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

Change control is built into the system via Git

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Users are independent Cribl Stream objects that you can configure even without RBAC enabled

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

URL of the Elastic server that will proxy non-bulk requests

A

Proxy URL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

While Splunk Search collector is a powerful way to discover new data in realtime, you should update the Request Timeout Parameter to stop the search after a certain period of time to avoid…

A

Having the collector stuck in a forever running state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Senders with load balancers built in include:

A

Elastic Beats
Splunk Forwarder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

When considering Filebeat, to ensure data is received at Stream, change the filebeat .yml to

A

‘setup.ilm.enabled: false’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

If Stream receives an event from Elastic Beats, we can deliver the event to

A

Any destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

Roles are a set of permissions

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

Cribl Stream ships with a Syslog Source in_syslog, which is preconfigured to listen for

A

Both UDP and TCP traffic on Port 9514

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

All syslog senders have built-in load balancing

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Review of Collectors

A

Stream Collectors are a special group of inputs that are designed to ingest data intermittently rather than continuously.
Collectors can be scheduled or run ad-hoc
Cribl Stream Collectors supports the following data types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Cribl Stream Collectors supports the following data types:

A

Azure Blob
Google Cloud Storage
REST
S3
Splunk Search
Health Check
Database
File System
Script

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Collectors in Single Deployments

When a Worker node receives the job:

A

-Prepares the infrastructure to execute a collection job
-Discovers the data to be fetched
-Fetches the data that match the run filter
-Passes the results either through the Routes or into a specific Pipeline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

Collectors in Distrubuted Deployments

In a distributed deployment, collectors are configured per Worker Group (within the Leader)

A

-The Worker Node execute the tasks to its entirety
-The Leader Node oversees the task distribution and tries to maintain a fair balance across jobs
-Cribl Stream uses “Least-In-Flight Scheduling”
-Because the Leader manages Collectors’ state, if the Leader instance fails, the Collection jobs will fail as well.\

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

Worker Processes

A

A Worker Node can have multiple worker processes running to collect data.
Since the data is spread across multiple worker processes, an alternative like Redis is required to perform stateful suppression and stateful aggregation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

Discovery Phase

A

Discovers what data is available based on the collection settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

Collection Phase

A

Collects the data based on the settings of the discovery phase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

Workers will continue to process in flight jobs if the Leader goes down.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

If skippable is set to yes, jobs can be delayed up to their next run time if the system is hitting concurrency limits.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Worker Nodes have

A

Multiple processes that process data independently

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Worker Nodes keep track of state when processing data?

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
102
Q

What happens after the Worker Node asks the Leader what to run?

A

The Leader Node sends work to Workers based on previous distributions of work.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
103
Q

Workers will stop processing collector jobs that are currently running if the Leader goes down

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
104
Q

Filesystem collectors and Script collectors can only run in a on-prem Stream environment

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
105
Q

What are the ways you can run a collection job?

A

Scheduled or AdHoc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
106
Q

The following collectors are available in Cribl Cloud

A

S3 Collector
and
REST Collector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
107
Q

You can run a scheduled collection job in preview mode

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
108
Q

Streaming Destinations

A

Accept events in real time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
109
Q

Non-streaming Destinations

A

accept events in groups or batches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
110
Q

Configuring Destinations

A

For each destination type, you can create multiple definitions, depending on your requirements. Definitions include Block, Drop, Queue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
111
Q

Value of Destinations

Support for many destinations

A

Not all data is of equal value. High volume low value data can be sent to less expensive destinations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
112
Q

Value of Destinations

Send data from the same source to multiple destinations

A
  1. Simplify data analytics tools migration
  2. Store everything you may need in the future, analyze only what you need now
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
113
Q

Value of Destinations

No extra agents required

A

Data collected once can be sent to multiple destinations without extra operations cost to run new agents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
114
Q

Value of Destinations

Integrations with common destinations

A
  1. Quick time to value
  2. Operations cost reduction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
115
Q

Value of Destinations

Live data capture shows what’s sent to destinations

A

Reduce troubleshooting effort

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
116
Q

Value of Destinations

Persistent Queue

A
  1. Minimize data loss
  2. Eliminate/minimize the need to introduce separate buffering/queueing tools
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
117
Q

Multiple Splunk Streaming Destinations

A

Splunk Single Instance - Stream data to a single Splunk instance
Splunk Load Balanced - Load balance the data it streams to multiple Splunk receivers (indexers)
Splunk HEC - Can stream data to a Splunk HEC (HTTP Event Collector) receive through an event endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
118
Q

Splunk Destinations Tips

Enabling Multi-Metrics

A

Multi-metrics is data sent in JSON format which allows for each JSON object to contain measurements for multiple metrics.
Takes up less space and improves search performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
119
Q

Splunk Destinations Tips

Adjusting timeouts and Max connections

A

Adjust timeout settings for slow connections. Increase request concurrenct based on HEC receivers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
120
Q

Splunk Destinations Tips

_raw Fields and index Time Fields in Slpunk

A

-Everything that is in _raw is viewable as event content
-outside of _raw is metadata which can be searched with tstats or by including :: instead of =
-Fields outside of _raw are viewe when event is expanded
-If events do not have a _raw field, they’ll be serialized to JSON prior to sending to Splunk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
121
Q

Splunk Destinations

Summary

A

-Cribl Stream can send data to Splunk using a variety of different options
-Data can be sent securely over TLS
-Enabling multi-metrics can save space and perform better

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
122
Q

Elastic Destinations

A

Bulk API - Performs multiple indexing or delete operations in a single API call

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
123
Q

Elastic Destinations

Data Structure Best Practice

A

Put all fields outside of _raw. use JSON

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
124
Q

Elastic Data Stream

A
  1. Create a policy > an index templatw
  2. Each data stream’s index template must include name or wildcard pattern, data stream’s timestamo field, and mappings and settings applied to each
  3. Source for data stream
  4. Destination for data stream
  5. Support for ILM
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
125
Q

Elastic Destinations

Key Use Cases

A

-Route data from multiple existing data sources or agents
-Migrate data from older versions
-Optimize data streams and send data in the right form to Elastic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
126
Q

Splunk > Elasticsearch

A

Step 1: Configure Splunk Forwarder
Step 2: Configure Splunk Source in Stream
Step 3: Configure Elasticsearch Destination
Step 4: Configure Pipeline (regex extract function, lookup function, GeoIP function)
Step 5: Results

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
127
Q

Destination: Amazon S3

A

Stream does NOT have to run on AWS to deliver data to S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
128
Q

Destination S3

Partitioning Expression

A

Defines how files are partitioned and organized - Default is date-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
129
Q

Destination S3

File Name Prefix Expression

A

The output filename prefix - Defaults to CriblOut
Use only with low cardinality partitions and understand impact to open files & AWS API

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
130
Q

Destination S3

Cardinality

A

=Max Unique Values
Number of Staging Sub-directories or S3 Bucket prefixes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
131
Q

Cardinality too high?

A

When writing to S3 - too many open files and directories on worker nodes
When reading from S3 - Less chance of hitting S3 read API limits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
132
Q

Destination S3

Cardinality too Low?

A

When writing to S3 - bigger files written to fewer directories in S3
When reading from S3 - Less filtering ability during replays, more data downloaded so larger data access charges, larger changer of hitting S3 read API limit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
133
Q

Cardinality General Guidance

A

Plan for cardinality of no more than 2000 / partition expression

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
134
Q

Stream to Stream

A

Sending data from Stream Worker to Stream Worker, not Worker to Leader

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
135
Q

Internal Cribl Sources

A

Receive data from Worker Groups or Edge Nodes
Common for Customer-managed (on-prem) Worker sends data to a Worker in Cribl.Cloud
Internal Cribl Sources treat internal fields differently than other Sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
136
Q

Internal Cribl Destinations

A

Enables Edge nodes, and/or Cribl Stream instances, to send data to one or multiple Cribl Stream instances
Internal fields loopback to Sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
137
Q

Stream Best Practices

A

-For maximum compression, it is best to change the data to JSON format
-Internal Cribl Destinations must be on a Worker Node that is connected to the same leader as the internal Cribl Source
-For minimum data transfer, process data on source workers instead of destination workers
-For heavy processing, process data on destination workers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
138
Q

When setting up an S3 destination the file name prefix expression:

A

Can negatively impact both read and write API count
Can dramatically increase number of open files
Generally avoid unless you’ve done your due diligence and have low cardinality partition expressions
All of the above

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
139
Q

It is not recommened to enable Round-Robin DNS to balance distribution of events between Elasticsearch cluster nodes

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
140
Q

What are two benefits of a worker group to worker group architecture?

A

Compress data and reducing bandwidth
Reducing Cloud provider egress costs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
141
Q

For heavy processing, a recommendation best practice is to process data on

A

Destination workers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
142
Q

When tuning settings for an S3 destination, a good way to avoid any “too many open files” errors is to decrease the number of max open files.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
143
Q

Which of the following allows you to configure rules that route data to multiple configured Destinations?

A

Output router
Parquet Formation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
144
Q

Which is an ideal scenario for worker group to worker group architecture?

A

Capturing data from overseas sources that is destined to local destinations
Reducing the number of TCP connections to a destination
Capturing data from a cloud provider and shipping it to an on-prem destination to avoid engress costs
all of the above

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
145
Q

With Exabeam, it is important to figure out what syslog format/content needs to be in place

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
146
Q

What are the two main considerations for S3 Destinations?

A

Cardinality of partition and file name expressions
Max open files on system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
147
Q

Stream S3 destination setting raw means

A

Less processing, smaller events, no metadata

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
148
Q

Routes

A

-Allow you to use filters to send data through different pipelines.
-Filtering capabilities via JavaScript expression and more control
-Data Cloning allows events to go to subsequent route(s)
-Data Cloning can be disabled with a switch toggle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
149
Q

Routes

Dynamic Output Destinations

A

-Enable expression > Toggle Yes
-Enter JavaScript expresion that Stream will evaluate as the name of the Destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
150
Q

Routes

Final Toggle

A

Allows you to stop processing the data depending on the outcome. If an event matches the filter, and toggle is set to Yes, those events will not continue down to the next Route. Events that do not match that filter will continue down the Route

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
151
Q

Routes

Final Flag and Cloning

A

-Follow “Most Specific First” when using cloning
-Follow “Most General First” when not using cloning
-At the end of the route, you will see the “endRoute” bumper reminder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
152
Q

Routes

Unreachable Routes

A

Route unreachable waarning indicator: “This route might be unreachable (blocked by a prior route), and might not receive data.
Occurs when matching all three conditions:
-Previous Route is enabled
-Previous Route is final
-Previous Route’s filter expression evaluates to true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
153
Q

Routes

Best Practices

A

Filter Early and Filter fast!
-you want to quickly filter out and data you do not want to process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
154
Q

Routes

Best Practices continued

A

-Certain JavaScript string operators run faster than others
-Each of these functions operates similarly to each other, but slighty different:
-indexof, includes and startswith use strings as their function parameter
-match, search, and test use regular expressions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
155
Q

Routes

Best Practices: Most Specific/Most General

A

Most General: If cloning is not needed at all (all Final toggles stay at default), then it makes sense to start with the broadest expression at the top, so as to consume as many events as early as possible

Most Specific: If cloning is needed on a narrow set of events, then it might make sense to do that upfront, and follow it with a Route that consumes those clones immiediately after

Object Storage (S3 buckets): Since most data going to object storage is data being cloned, it is best to put routes going to object storage at the top.

Filter on common fields. Filter on fields like inputid, and metadata fields, rather than _raw.includes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
156
Q

You created a QuickConnect against a source and now you want to create a route against a subset of that source’s events - to a different destination. What are the steps you need to take?

A

Navigate to the Source. Go to ‘Connected Destinations’. Click on ‘Routes’ to revert to using them instead of QuickConnect. Create 2 routes: one to replace the old QuickConnect that was deleted, and a new route with a filter to map to the events of interest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
157
Q

Both QuickConnect and Routes can be used against the same source.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
158
Q

What’s the general rule for having a performant system?

A

Filter early and filter fast!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
159
Q

Which is true?

A

-Routes have drag and drop capabilities to connect to a source to a destination; QuickConnect doesn’t (FALSE)
-QuickConnect has advanced capabilities to assign for assigning pre-processing pipelines to a source and post-processing pipelines to a destinations (FALSE)
-QuickConnect does not allow mapping a Pack between sources and destinations (FALSE)
-Routes map to a filter; QuickConnect maps a source to a destinatiosn (TRUE!!!!)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
160
Q

Which is the most performant JavaScript function?

A

indexOf

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
161
Q

Which is a good use case for QuickConnect?

A

-Stream Syslog Source receiving events from hundreds of device types and applications (NOOOOOOOO)
-Stream Splunk Source receiving events from Windows and Linux hosts with Splunk Universal Forwarders (NOOOOOO)
-REST API Collector polling Google APIs with JWT authentication (NOOOOOO)
-Palo Alto devices sending to a dedicated Stream Syslog Source mapping to a different port than other syslog events (YESSSSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
162
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
163
Q

Filter Expressions

A

Filter Expressions are used to decide what events to act upon in a Route or Function. Uses JavaScript language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
164
Q

Value Expressions

A

typically used in Functions to assign a value. Uses JavaScript language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
165
Q

There are 3 types of expressions

A

-Assigning a Value
-Evaluating to a Value
-Evaluating to true/false

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
166
Q

Filter Expressions Usage

A

Filter Expressions can be used in multiple places:
-Capture
-Routing
-Functions within Pipelines
-Monitoring Page

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
167
Q

Special Use Expressions

Rename Function - Renaming Expression

A

name.toLowerCase(): any uppercase characters in the field name get changed to lowercase
name.replace(“geoip_src_country”, “country”): This is useful when JSON objects have been flattened (as in this case)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
168
Q

Filter Expression Methods

A

Expression methods can help you to help determine true or false. Here is a list of commonly used methods:
.startswith: Returns true if a string start with the specified string
.endswith: Returns true if a string ends with the specified string
.includes: Returns true if a string contains the specified string
.match: Returns an array containing the results if the string matches with a regular expression
.indexOf: returns the position of the first occurrence of the substring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
169
Q

Cribl Expressions Methods

A

Cribl Expressions are native methods that can be invoked from any filter expression. All methods start with C.

Examples: C.Crypto or C.Decode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
170
Q

What operators are available to be used in Filter Expressions?

A

&&
||
()

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
171
Q

The Filter Expression Editor allows you to

A

Test your expression against sample data
Test your expression against data you have collected
Test your expression against data to see if it returns true or false
Ensure your expresison is written correctly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
172
Q

Filter Expressions are only used in Routes

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
173
Q

Select all the Fitler Expression operators you can use

A

”>”
“<”
“==”
“!==”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
174
Q

Filter Expressions can be used in the following places

A

Functions within Pipelines
Routes
Monitoring Page
Capture Page

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
175
Q

You can combined two Filter expression

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
176
Q

What is the difference between using “==” or “===”

A

”==” checks that the value is equal but “===” checks that the value and type are equal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
177
Q

You can use .startsWith and .beginWith in filter expressions

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
178
Q

Pipelines

A

Pipelines are a set of functions that perform transformations, reduction, enrichment, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
179
Q

Benefits of pipelines

A

-Can improve SIEMs or analytics platforms by ingesting better data
-Reduce costs by reducing the amount of data going into a SIEM
-Simplifies getting data in (GDI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
180
Q

Pipelines are similar to

A

Elastic LogStash
Splunk props/transforms
Vector Programming

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
181
Q

Types of Pipelines

A

Pre-Processing - Normalize events from a Source
Processing - Primary pipeline for processing events
Post-Processing - Normalize events to a Destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
182
Q

Type of Pipelines

Pre-Processing

A

This type is applied at the source
Used when you want to normalize and correct all the data coming in
Examples:
-Syslog Pack pre-processing all syslog events coming from different vendors; specific product packs/pipelines can then be mapped to a route
-Microservices pack pre-shapes all k8s, docker, container processed logs
-Specific application pipeline/packs can then be mapped to routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
183
Q

Types of Pipelines

Processing Pipelines

A

Most common use of pipelines
you can associate pipeline to routes using filters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
184
Q

Types of Pipelines

Post-Processing

A

Maps to Destinations
Universally post-shape data before it is routed
Examples:
-Convert all fields to JSON key value pairs prior to sending to Elastic
-Convert all logs to metrics prior to sending to Prometheus
-Ensure all Splunk destined events have the required index-time fields (index, source, sourcetype, host)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
185
Q

Pipelines

Best Practices!

A

Name your pipeline and the route that attaches to it similarly
-Create different pipelines for different data sets. Creating one big pipeline can substaintially use more resources, become unmanagable, and look confusing and complicated.
-Filter early and filter fast!
-Do not reuse pipelines. Do not use the same pipeline for both pre-processing and post-processing. Can make it hard to identify a problem and where it stems from
-Capture sample events to test. Allows you to visualize the operation of the functions within a pipeline.
-Test! Use data set to test and validate your pipeline
-Use statistics. Use Basic Statistics to see how well your pipelines are working
-Pipeline Profiling - determine performance of a pipeline BEFORE it is in production

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
186
Q

You should create different pipelines for different data sets

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
187
Q

Pipelines contain Functions, Routes and Destinations

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
188
Q

Stream Functions Overview

A

-Functions act on received events and transform the received data to a desired output.
-Stream ships with several functions that allow you to perform transformations, log to metrics, reduction, enrichment, etc.
-Some expressions use JavaScrip
-For some functions, knowning Regex will be required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
189
Q

5 Key Functions

A

Eval
Sampling
Parser
Aggregations
Lookup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
190
Q

Types of Functions

Eval

A

Evaluate fields - Adds or removed fields from events
Keep and Remove Fields - Keep fields take precedence over remove fields

191
Q

Types of functions

Parser

A

It extracts fields out of events, or can be used to manipluate or serialize events

192
Q

Types of Functions

Parser

A

Types
CSV - splits a field containing comma separated vvalues into fields
Delimited Values - Similar to CSV, but using any delimiter
Key=Value pairs - Walks through the field looking for key value pairs (key=value) and creates fields from them.
JSON Object - Parses out a full JSON object into fields
Extended Log Format - Parses a field containing an Apache Extended Log Format event into fields
Parses a field containing an Apache Common Log Format event into fields

193
Q

Types of Functions

Lookup

A

Looks to enrich your events from other data sources. Performs look ups against fixed databased such as CSV,CSV.GZ
Theres three match modes: Exact, CIDR, regex
Three match types for CIDR and Regex: First Match, Most specific, All
GeoIP: Performs looks up against fixed databased like MMDB or Maxmind
DNS Lookup: Performs DNS queries and returns the results
Redis: Supports the entire REDIS command set

194
Q

Types of Functions

Lookups - Things to look out for

A

-Exact match will be case sensitive
-Results will be added as fields in the event
-Order your lookup from most specific to least
-Create efficient regex
-For DNS enrichment, use local caching DNS

195
Q

Types of Functions

Aggregations

A

allows you to apply statistical aggregation functions to the data to generate metrics for that data

196
Q

Aggregation Functions

Avg()

A

which returns the average values of the parameter specified (for example, the parameter is a field that contains the number of bytes in, say a firewall transaction, avg will return the average number seen in the time window

197
Q

Aggregation functions

median()

A

Will similarly return the median (the “middle” number of the sorted values of the parameter within the time window)

198
Q

Aggregation functions

min() and max()

A

each returns the minimum or maximum value, respectively, of the parameter within the time window

199
Q

Aggregation functions

perc()

A

returns the specified percentile of the values of the specified parameter

200
Q

Aggregation functions

per_second()

A

returns the rate that the different values of the parameter occur at in the event window

201
Q

Aggregate function tips

A

Stream is a share nothing architecture.

202
Q

Types of Functions

Sampling

A

duplicates events as they are passing through Stream

203
Q

Types of functions

Mask

A

Mask/Replace/Redact patterns and events. helpful for masking personal information

204
Q

Types of functions

Regex Extract

A

Extract using regex named groups

205
Q

Types of Functions

General purpose

A

Eval, parser, drop, aggregations, rename

206
Q

Types of functions

Enrichment

A

Lookup, DNS lookup, GeoIP, Redis

207
Q

Types of functions

Statistical

A

Dynamic sampling, publish metrics, rollup Metrics

208
Q

Types of functions

Advanced

A

Chain, Clone, Code, Event Breaker, JSON Unroll, Tee, Trim timestampl, Unroll, XML Unroll

209
Q

Types of functions

Formatters

A

CEF serializer, flatten, serialize

210
Q

Functions Best Practices

A

-Use typeahead to get a list of functions you can use in JavaScript
-You can use tooltips to get help on most fields in the UI by clicking the question mark
-Add comments and descriptions to your functions in order to explain what is happening
-Function groups allows you to group a set of functions together
-Use the three dotes to access additional functions to a pipeline

211
Q

The Parser command can extract fields from the following data types

A

CSV
delimited values
JSON Object
SQL (incorret, it cannot parser this)

212
Q

Which function allows you to create metrics out of any data set?

A

Aggregations

213
Q

The Mask function allows you to replace data in events

A

True

214
Q

Which functions allows you to de-duplicate events as they pass through Stream?

A

suppress

215
Q

You can add or remove fields using JavaScript expressions with the Parser function

A

True

216
Q

Which function allows you to easily extract fields out of events?

A

Parser

217
Q

Which function can add or remove fields from events?

A

Eval

218
Q

Which functions allows you to enrich your events from other data sources?

A

Lookup

219
Q

The sampling function allows you to get samples of data for testing purposes?

A

False

220
Q

Lookups cannot be used to enrich data

A

False

221
Q

Stream Packs Overview

A

Packs let you Pack up and share Stream configurations and workflows across Worker Groups, or across organizations

222
Q

What is in a Pack?

A

Packs contain everything between a Source and a Destination

223
Q

What is not in a Pack?

A

Sources
Source Event Breakers
Collectors
Destinations
Knowledge Objects

224
Q

Packs

A

Make them useful for the community. Include sample files and lookups to ensure the community can test your pack
Make them reusable. Make sure you include details on how to configure any relevant Sources and Destination

225
Q

Good Pack Standards

A

-start names with cc for community members. use all lower case letters. use dashes for separate words

226
Q

Pack - Best Practices

A

-There is no concept of a Local directory inside the Data directory
-Changes to Pack will create a local copy of that change
-Local always wins over default
-Making changes to routes will create a local version of route.yml

227
Q

Packs - Best Practices: Deleting Defaults

A

-Never delete anything in the default folder
-If you delete items in default, they will reappear when you reload configs or restart the leader
-Workaround: Untar the pack in the CLI, carefully delete things and update the appropriate references in the files, tar up the contents of the Pack from within the pack folder

228
Q

Packs - Best Practices: Updating Knowledge Objects

A

-Never modify Knowledge objects that ship with the pack
-If you modify any knowledge object that ships with the Pack, it will be overwritten. This includes lookups, etc.
-Workaround - create a new knowledge object, any new knowledge object will not be overwritten

229
Q

Packs - Best Pratices: Cannot see updates

A

-Pack was updated but you cannot see any new updates or new features
-since local has a higher preference, you will not see any of the new updates that are in the default
-Workaround: delete and install the new pack, import the updated pack, import the pacck with a new ID each time you install a PAck update, merge local changes from the older pack into the newer pack

230
Q

Packs - Best Practices: Deleting Pack Routes

A

-Do not delete routes in a pack
-you deleted all the routes in a pack and reinstalled the pack but the routes do not return
-Workaround: delete the pack, restart the leader, reinstall the pack again

231
Q

Packs - Best Practice: Tips and Tricks

A

-review the README to understand Pack updates
-Import the Pack with a separate/unique ID to see the new updates
-Exporting a Pack with the merge option selected will overwrite defaults and will merge any local changes
-The Cribl Knowledge Pack is a great way to learn more advanced functions in Stream

232
Q

In a distributed deployment, Packs are distributed to the worker group level

A

True

233
Q

Packs can be imported using which of the following ways

A

-import a file
-import from a URL
-import from Git
-import from https://packs.cribl.io

234
Q

All Packs that are created will automatically be shared with the community

A

False

235
Q

Packs can….(select all that apply)

A

-Enable plug and play deployments for specific use cases
-Improve time to value by reducing hurdles and providing Cribl Stream users with out of the box pipelines
-Target users in medium/large deployments sharing configurations and content across multiple worker groups

236
Q

Without packs, an administrator must do all pipeline configuration manually

A

True

237
Q

Users are allowed to create packs and can share them with the community, if applicable

A

True

238
Q

You can find existing Cribl Packs by searching https://packs.cribl.io

A

True

239
Q

What are Packs?

A

Pre-built configuration blocks designed to simplify the deployment and use of Cribl Stream

240
Q

Which is the best answer for how packs are created?

A

-Cribl creates packs and makes them available for Cribl Stream users
-Partners and Users can create packs and make them available for Cribl Stream users
-Downloaded packs can be edited for specific needs and then shared
-ALL OF THE ABOVE IS CORRECT

241
Q

When exporting a Pack, what are the three export mode options?

A

Merge safe, Merge, and Default only

242
Q

Stream Replay Overview

A

-Route data to cheap storage, Replay it back later
-Search and Replay only the data you need
-Send the Replayed data to any destination

243
Q

Object Store vs Alternatives

A

Recommendation: Use Object Store
Cost: Object Store is 70-95% cheaper than alternatives
Metadata and searchability: Searching Object Store is a top choice for high volumes of data. Searching File storage is more appropriate for lower volumes of data.
Volume: For high volumes of data, object or block storage are best
Retrievability: Data is relatively retrievable from all three types of storage, though file and object storage are typically easier to access
Handling of metadata: typically, best served by object storage

244
Q

Replay

Worker Group

A

Recommendation: Use dedicated Worker Group
No impact on Production Worker Nodes: Use dedicated Worker Group to process large amount of historical data and avoid impact on other workloads
Egress: Place the Worker Group in the same Cloud provider as the Object Store (S3) and Destination
Dynamic Scaling: If possible, use Dynamic Scaling, for example in Kubernetes

245
Q

Replay

Partitions

A

Recommendations: Partitining Expression on Destination should be the same as the Partitioning Expression on the Collector

246
Q

Replay

Enable User Friendly Replays

A

Recommendation: Enable user friendly replays

247
Q

Replay

Search

A

Recommendation: Use Partitioning Expression in Search. Do not use content from within the events

248
Q

Replay

Destination

A

Recommendation: Use a field to mark the data you want to Replay. Send Replayed data to any destination

249
Q

Replay Summary

A

Replay means jumping into critical logs, metrics and traces as far back in time as you want, and saying “let’s see that again.”
Keep more data for longer retention periods and pay a lot less
Replay data to any analytics tools for unexpected investigations
Improve the quality and speed of your analytics environment by saving older data somewhere else
Using Object Store (S3) is the most effective storage

250
Q

Cribl recommends using a dedicated worker group to process your replay data

A

True

251
Q

An AWS S3 Key Prefix is the same thing as a Cribl S3 Key Prefix

A

False

252
Q

Which is a use case for routing data to an Object Storage? Select all that apply

A

-Reducing Analytics tool or SIEM spend
-Making data available for other soultions
-Replaying historical data for a threat hunting exercise
-Replaying debug logs for a troubleshooting event
Correct Answer is all of the above!

253
Q

Replay data should be sent to a dedicated index if the destination is Elastic or Splunk

A

True

254
Q

Cribl recommends using production worker groups to process your replay data

A

False

255
Q

To make it easier to identify events that been replayed…

A

Use a unique Index name

256
Q

When considering replay, which of the following are best served by using an object storage. Select all that apply

A

Retrievability
Handling of metadata
Cost
NOT permissions

257
Q

Which of the following can be used when Cribl Replays data from an Object Storage?

A

Partitioning Expression filtering
File name Expression filtering

258
Q

For Replay to work, you must put all data in JSON format

A

False

259
Q

Cribl Edge

Why at the Edge?

A

-The edge is where we see the most data being generated
-Use data directly from the edge without having to move it

260
Q

Installing Cribl Edge Nodes

A

-Able to install on Docker, Kubernetes, Linux, and Windows Servers
-To install, go to Manage > Edge Nodes > Add/Update Edge Node
-Provides customizable scripts for each operating system

261
Q

Cribl Edge

Kubernetes Sources

A

-Kubernetes Logs (collects container logs and system logs from containers on a Kubernetes Node)
-Kubernetes Events (collects cluster-level events from a Kubernetes Cluster
-Kubernetes Metrics (collects events periodically based on the status and configuration of the Kubernetes cluster)

262
Q

Cribl Edge

Linux Sources

A

-System Metrics (collects metrics data including messages from CPU, Memory, Network, and Disk)
-Journal Files (centralized location for all messages logged by different components in a systemd-enabled system)

263
Q

Cribl Edge

Windows Sources

A

-Windows Event Logs (collects standard event logs, including Application, Security, and System logs)
-Windows Metrics (collects metrics data from Windows hosts)

264
Q

Cribl Edge

Cribl HTTP and Cribl TCP destinations

A

-Enable Edge Nodes to send data to peer Nodes connected to the same Leader
-Cribl HTTP (best suited for: Distributed deployments with multiple workers. Use of load balancers. Valuable in hybrid cloud deployments.)
-Cribl TCP (best suited for: medium size deployments. All on prem. Valuable in certain circumstances)

265
Q

Cribl Edge

Cribl HTTP and Cribl TCP continued

A

-HTTP/TCP Destination must be on Edge Node connected to the same Leader as HTTP/TCP Source
-Must specify same Leader Address on Edge Nodes that host Destination and Source
-To configure Leader Address via UI > log into Edge Node’s UI
-Destinations Cribl endpoint must point to peer Address and Port of Source
-When configuring hybrid workers, Edge Nodes that host Destination / Source must specify exact same Leader Address

266
Q

Cribl Edge

Setting Up Edge to Stream

A

1) Cribl Source to receive data from Edge Node
2) Configure Destination on Edge to send data to Stream
3) Configure Route to send your data to Stream

267
Q

Cribl Edge

Summary

A

-Deploy to a variety of machines using provided scripts (ability to deploy to a wide variety of systems including Linux servers, Windows servers, Docker containers and Kubernetes)
-Capture sources from a wide variety of systems (built in sources allows for quick and easy configuration to gather the data you need)
-Combine with Cribl Strea (When using Edge with Stream, you unlock the power of Stream by using Workers to process the data)

268
Q

What is AppScope?

A

-Open source, runtime-agnostic instrument utility for any Linux command or application
-Offers APM-like, black-box instrumentation of an unmodified Linux executable and application
-Interposes itself between applications and share libraries and system calls
-Observe applications from the inside, viewing resource consumption, filesystem traffic and network traffic including clear text payloads

269
Q

AppScope

Data Routing

A

-AppScope gives you multiple ways to route collected data.
The basic operations are:
-in a single operation, you can route both events and metrics to Cribl Edge, default configuration
-You can also route both events and metrics to Cribl Stream, local instance or in the Cribl.Cloud
-Support routing events and metrics to a file, a local Unix socket or any network destination, in addition to Cribl Edge and/or Stream

270
Q

AppScope

Installing AppScope

A

-Go to Cribl.io, download from the top menu, download your preference.
-Installing: Load and execute via CLI, done and ready to start working

271
Q

AppScope

Configuring AppScope

A

Scope.yml is the sole library configuration file for AppScope. Environment vvariables override configuration settings

272
Q

AppScope

Using AppScope: Scoping your first command

A

State ‘Scoping’ - the most basic command: /bin/echo
another command: scope metrics
scope events
scope events 0 (gives info on that event)
scope events -j | jq - events in JSON format

273
Q

AppScope

Tracking Scope History

A

scope hist (defaults to last 20)
to scope a specific session use the ID. example: scope hist –id 2

274
Q

AppScope

Scoping Applications

A

‘scope perl’
‘scope events’
‘scope events –id 1 - fs.open’ (file system events)
-a says to output all events
-j outputs events as JSON
-jq filters down to just the file names
sort and uniq helps us find only the unique filenames opened

275
Q

AppScope

Log Data

A

bat log.py
scope python3 log.py

276
Q

AppScope

Network Metrics

A

scope sh -c ‘echo “some bytes” | nc -w1 localhost 10001’
scope metrics -m net.tx -m net.duration –cols

277
Q

AppScope

Network Events

A

scope events -t net

278
Q

AppScope

Network Flows

A

scope flows
scope flows ir1JM1 (flowID)

279
Q

AppScope

HTTP Events

A

scope curl -so /dev/null http://localhost/
scope events

280
Q

AppScope

AppScope Graphics

A

scope metrics -id 1 -g proc.cpu_perc
scope metrics –id 1 -g -m proc.fd

281
Q

AppScope

AppScope Summary

A

Detailed Telemetry: automatically collects application performance data. Automatically collect log data written by the application
Easy Management: Use the CLI when you want to explore in realtime, in an ad hoc way. Use the AppScope library (libscope) for longer-running, planned procedures
Platform Agnostic: Offers ubiquitous, unified instrumentation of any unmodified Linux executable. Supports single-user or distributed deployments

282
Q

Cribl Edge allows you to run executables and collect the output of the command

A

True

283
Q

Cribl Edge cannot auto-discover log files on the system

A

False

284
Q

By using Cribl Stream Leader, you can tell Cribl Edge what files you want to monitor using the GUI

A

True

285
Q

Cribl Edge does not allow you to see machine metrics such as CPU, Memory, or IO

A

False

286
Q

AppScope provides a CLI based dashboard to see the status of AppScope

A

True

287
Q

Cribl Edge allows you to replace your data ingestion agent with a vendor agnostic agent

A

True

288
Q

AppScope interposes itself between applications and shared libraries and system calls

A

True

289
Q

AppScope is an open-source, runtime-agnostic instrumentation utility for any Linux command or application

A

True

290
Q

Which AppScope command allows you to see a history of scoped commands?

A

scope hist

291
Q

You cannont send AppScope data to Cribl Stream

A

False

292
Q

TLS Keys

How to Stat Using Public Key (RSA) Cryptography

A

Step 1: A private key (a large prime #) is (always) created first using a took like openssl
Step 2: Using the private key, a public key (another large prime #) is created and embedded in a Certificate Signing Request. This requires specifying minimum set of info: subject’s name (CN=), org name, OU, city, state, country, and possibly subject alternative name (SAN)
Step 3: The CSR is signed, either by it’s own private key or a CA’s key
Step 4: You now have a certificate with a private key

293
Q
A
293
Q

Things to keep in mind when working with Certs and Keys

A

-a cert cannot exist without being signed
-public key (in signed certificate) can encrypt/verifiy data
-Private key can decrypt/sign data
-Caveat: Entity possessing the private key may not be the rightful owner

294
Q

Certificate Authorities

A

-CAs are used to sign Cert Signing Requests
-Public vs Private - depends on the needs such as vetting levels, cost, cert visibility
-The first/top-level CA is the root > assertion of trust
-The second CA is an subordinate/intermediate - option but best practice

295
Q

Self-Signed Certificates

A

-Self signed certificates are not simply ones you sign yourself
-self-signed cert is simply one signed by the same entity whose identity it certifies
-Every root CA cert is self-signed
-Every self-signed cert is also a root but not necessarily a CA
-Still provides confidentiality, but authenticity and data integrity are suspect
-CA-signed (public or private) certificates mititgates these issues
-One step further is having the CA root cert deemed a trusted root by applications

296
Q

Levels of trust

A

Increasing trust as u go down the list:
-Unsigned certs (no such thing)
-Self-signed certs
-Private CA-sgned certs
-Public CA-signed certs
-CA-signed certs whereby the CA is deemed trusted

297
Q

Certificate Chains

A

-Chains exist when a non-self-signed certificate is involved
-Many public CAs use chains to protect their root certs
-Frequently used within organizations handling their own signing
-Validating chains - starts at the bottom and moves up the chain to the root:
issuer of each cert matches the subject of the next cert (except for the root)
Each cert is signed by the private key corresponding to the next cert up the chain (except root)
Last cert (top of the chain) is the trust achor

298
Q

What is a Cipher Suite?

A

-Client and server applications are configured with a set of ciphers
-Consist of multiple categories of algorithms
-Many combinations exist as discrete suites
-SSL/TLS versions have cipher suites associated with them
-When a TLS version is released, new ciphers may be provided
-Old ciphers can be deemed insecure > deprecated

299
Q

Components of a cipher suite (<TLS 1.3)

A
  1. Protocol: TLS in this example
  2. Key Exchange: During the handshake the keys will be exchanged via ephermeral Ellitic Curve (EC) Diffie Hellman (ECDHE)
  3. Authentication: ESDSA is the authentication algorithm
  4. Bulk Encryption: AES_128_GCM (symmertric), specficially w/ Galois Counter Mode using a 128-bit key size
  5. Hash: SHA-256
300
Q

Working with Certificates Summary

A

-Asymmetric encryption will be important any time you are looking to encrypt data from sources/destinations to most modern applications, including Stream
-PKI involves a public key used to encrypt data and a private key used to decrypt the public key encrypted data
-Certificates can be self-signed or signed by a Certificate Authority, self signed can be used for internal to internal encryption

301
Q

What type is encryption utilizies a public/private key pair?

A

Asymmetric

302
Q

A self signed certificate has a higher level of trust than a public CA signed certificate

A

False

303
Q

(Select all that apply) TLS utilizes

A

Symmetric encryption and Asymmetric encryption

304
Q

What does CA stand for in PKI?

A

Certificate Authority

305
Q

KMS (Key Management Service) Overview

A

-Cribl Stream encrypts secrets stored on disk
-The keys used for encryption (cribl.secret) are managed by KMS
-The keys are unique to each Worker Group + Leader
-Encryption key can be managed by Cribl Stream or by an external KMS
-Secrets encrypted by the Key: Sensitive information stored in configs and data encryption keys stored as configs

306
Q

Benefits of Using External KMS

A

-Centralized key management for your organization
-Change and access audit
-High availability key management options
-Minimizing key exposure

307
Q

KMS Options

A

Stream Internal is the default KMS. Changing your KMS is not available with Stream free license
-to get to KMS Settings: Settings > Security > Secrets
-A System/Leader key; additional keys for each Worker Group
-If HashiCorp Vault or AWS KMS are used, Leader and Worker Nodes must have network access to the external KMS

308
Q

Setting HashiCorp Vault as the KMS

A

-Keys are set up separately at the Leader and each Worker Group levels to contain secrets access to the Worker Groups and the Leader
-After KMS configuration is performed in Cribl Stream, the specified Secret Path will be created in the Vault

309
Q

KMS Best Practices

A

-Backup your cribl.secret files before switching to external KMS
-Switching from external to internal KMS while the external KMS is not accessible may render your Cribl Stream environment unusable
-If an external KMS is used, Leader AND Worker Nodes must have access to the external KMS to operate
-Test your KMS configuration in a non-production Cribl Stream environment

310
Q

Once you configure a Worker Group with a KMS system, it will sync with the other Worker Groups

A

False

311
Q

Where is KMS configured in a distributed Stream environment?

A

Separately, in the Leader Node and Worker Groups settings

312
Q

Secrets are not encrypted when stored to disk

A

False

313
Q

(Select all that apply) What external KMS system, does Stream integrate with?

A

HashiCorp Vault
AWS KMS

314
Q

Worker Groups and Leader have a unique set of keys that are used for encryption

A

True

315
Q

External KMS is required for Stream to function

A

False

316
Q

Workers configured with external KMS will function if the KMS cannot be reached from the Workers

A

False

317
Q

Once you configure the KMS system on the Leader, the Leader will push out the configuration to the Workers

A

False

318
Q

You can use a KMS provider with the free version of Cribl Stream

A

False

319
Q

If using an external KMS, the Leader and Workers must have access to the external KMS to operate

A

True

320
Q

Stream Cert Validations

Configuring settings as a TLS server

A

-Authenticate Client (mutual auth) - if true, server requests client cert. Off by default
-Validate Client - Clients whose certs aren’t authorized (i.e. signed by built-in CAs) have connection denied. Off by default
-Mutual auth enables optional CN validation via regex

321
Q

Stream Cert Validations

Validation checks (by NodeJS) when client/server validation is enabled

A

-Leaf cert expiration and validation of CA chain then
-CN / SAN checks per RFCs
-Only one is checked, regardless of no matches. SAN checked first, if values exist.
-IPs are only accepted if theya re in both SAN and Subject attributes

322
Q

Stream Cert Validations

A

-Stream as a client can validate the remote server certification using Validate server certs toggle
-Some destinations (like AWS) allow rejecting unauthorized (example is self-signed certs)
-If GUI does not provide a Reject Unauthorized toggle, then a global one can be used (Requires a restart and must be included in systemd unit file)

323
Q

Creating your own certs

A

generating a self-signed certificate with openssl

324
Q

Configuring Stream Cert & Chain

A

-For self-signed, simply add the cert to the Certificate field
-Preferably, use the CA Certificate field for importing one or more CA certs. Pros: avoids using NODE_EXTRA_CA_CERTS. Cons: not obvious trusted CA certs are associated with this host cert
-Sub/root CA certs can be added to the Certificate field

325
Q

Best Practices: Certs in Worker Groups

A

-Worker nodes should appear identical to external systems
-Worker nodes should internally reflect their individuality for better security
-API and cluster settings on a node can use the same cert reflecting the worker’s name
-Subject (CN is hostname) and SAN should be defined
-Use the SAN to include all possible names
-Manage certs via UI == each worker gets the full cert set

326
Q

Best Practices: Certs in Worker Groups

A

-Separate (from API/custer) certs can and should be used (managed via GUI) for src/dst configs to reflect the worker group’s FQDN
-Two Options: Single cert for all workers, or different cert on each worker
-Former is more scalable due to wildcard but validationfails if connecting with IPs
-Depending on details (example key size) some systems may not accept the configured cert
-For both options, trusted root CA (vs internal CA) is preferred and possibly required

327
Q

Single Worker to Leader Traffic (alt. option)

A

-TLS can also be configured for Worker to LEader comms using the intance yaml file, environment variables, or via CL
-yaml config will be done via the $CRIBL_HOME/local/_system/instance.yml file under the distributed section

328
Q

Certs

Troubleshooting

A

Logs:
-$CRIBL_HOME/log/cribl.log
-Certs/TLS errors will be logged here. If workers are not showing up on the leader check the worker logs for cert errors.
-$CRIBL_HOME/local/_system/instance.yml
-Contains TLS settings, helpful if the workers are not connecting

Tools
-openssl s_client -connect host:9000
-This will give you details of the certificate being presented on the port, can be useful to verify the certificate details

329
Q

Certs/TLS Summary

A

-TLS can be a complicated feature to enable, proper planning and having a basic understanding of TLS client server architecture can help
-There are multiple places that TLS can be used
-Worker to Leader, Source to Worker, Worker to Destination, Leader GUI
-Have a means to track certificate issuance and expiration
-Use the Stream logs to assist in troubleshooting TLS problems

330
Q

The Leader TLS can be disabled/enabled via the CLI

A

True

331
Q

TLS does not work in containerized environments

A

False

332
Q

(Select all that apply) With GUI or API access, which components are the server in the client/server model?

A

-Worker
-Leader
-NOT Client or Browser

333
Q

A Leader to Worker TLS connection supports Mutual authentication

A

True

334
Q

Node.JS uses the system certificate store to validate certificates

A

False

335
Q

Cribl Stream Projects

Configuration Steps

A

-Configure Cribl Member
-Create a Cribl Member user with the correct access to Stream and other products
-Provide the new Cribl Member access to their Worker Group
-Configure Stream Project
-Create a Subscription
-Create a Data Project using the Subscription above
-Add available destinations to the project
-Assign Users
-Give a Cribl member permissions to the Stream Project

336
Q

Cribl Stream Projects

Cribl Members

A

-Provides control over who has access and visibility within Cribl Projects
-Compliments current authentication methods but will eventually replace them
Settings > Global Settings > Access Management > Members

337
Q

Cribl Stream Projects

Configuring - Worker Group Access

A

Worker Group > Group Settings > Access Management > Members

338
Q

Cribl Projects

Roles

A

Admin: Full Access
Editor: Can modify resources within the group
Read Only: has read only access to resources within the group
User: no access unless shared

339
Q

Cribl Stream Projects

Configuring - Subscriptions

A

Worker Group > Projects > Subscription

339
Q

Cribl Stream Projects

Configuring - Data Projects

A

Worker Group > Projects > Data Projects

339
Q

Cribl Stream Projects

Summary

A

-Cribl Admin can provide teams/users with specific data without mdoifying data for other users
-Cribl Members provide granular access to Cribl products including Stream, Edge and Search
-Stream Projects enable users to have control over their data by providing granular access to data flowing through Cribl Stream

340
Q

Using Projects…..

A

the team can share complex Cribl Stream data through the subscription

341
Q

What is a Metric?

A

-Metrics are a number respresentation of data measured over intervals of time
-Metrics can be an incredibly useful and important part of your observability strategy
-Many logging systems extract and calculate metrics
-Cribl Stream can extract metrics that are not always available

342
Q

Logs to Metrics

A

-Logs can take up a lot of space and come from multiple systems
-Metrics tend to be leaner and faster
-Solution: Calculate metrics to send to analytics system, and archive the rest

343
Q

Cribl Stream and Metrics

A

-Cribl Stream pipelines contain functions to aggregate or transform logs to metrics
-Extract data from a log line, convert that data to metrics
-Three different functions
-Aggregate
-Publish metrics
-Rollup metrics

344
Q

Cribl can only pass on data as metrics if the data is ingested into Cribl as a metric

A

False

345
Q

Logs tend to be way leaner in terms of storage requirements compared to metrics

A

False

346
Q

Metrics are a numeric representation of data measured over intervals of time

A

True

347
Q

Cribl Stream provides three different pipeline functions (aggregate, publish metrics, and rollup metrics) to use to convert your logs to metrics

A

True

348
Q

Cribl is not able to enrich metrics before they are sent to their destinations

A

False

349
Q

Metrics offer better analysis experience and faster performance compared to logs

A

True

350
Q

What exactly is a Trace?

A

-Traces represent the end to end request flow through a distributed system
-the data structure of traces looks almost like an event log
-Traces are made up of spans. Spans are events that are apart of a trace

351
Q

Traces and App Monitoring

A

-In App Monitoring, traces represent what applications spend time on
-Used by app developers to measure and identify least performant calls in code
-Trace generation and analysis is often done by APM tools

352
Q

Trace Spans

A

Each span begins with: traceid, name, id

353
Q

Cribl Stream and Traces

A

Cribl Stream can receive and route data without having to stitch, remove irrelevant data, create metric data
Cribl Stream can process raw OptenTelemetry data without app-level changes. Also store raw data indefinitely (such as AWS S3)

354
Q

Cribl Stream needs to stitch traces in order to receive and route data

A

False

355
Q

When Cribl Stream transforms raw Otel data, it is done at the app-level

A

False

356
Q

Traces are made up of spans

A

True

357
Q

Each span begins with an index

A

false

358
Q

TraceID is shared across all spans in the trace

A

True

359
Q

Traces are used by app developers to measure and identify least performant calls in code.

A

True

360
Q

Leader Node Logs

A

-API/main process in $CRIBL_HOME/log/directory
-Config Helper process in $CRIBL_HOME/log/group/GROUPNAME directory

361
Q

Worker Node Logs

A

-API process in $CRIBL_HOME/log/directory
-Worker process in $CRIBL_HOME/log/worker/WP#/directory

362
Q

Who is watching the watcher?

A

Pro: Easy to use Cribl Stream to send its own logs
Cons: if something isn’t working, logs might not get sent

363
Q

Leader Node Logs

A

-Leader itself doesn’t process data, so it can’t forward its own logs
-You can use any file collection option, such as Elastic Filebeat, Splunk Universal Forwarder, Cribl Edge, etc.
-Logs can be collected from the leader via /system/logs API endpoint

364
Q
A
365
Q

Logging

Summary

A

-Logs can be viewed on disk, Leader UI, or Forwarding
-You have control over logging level or redaction
-Forwarding can be convienent but has trade offs

366
Q

Leader Node logs are located in

A

$CRIBL_HOME/log

367
Q

Notifications.log contains alerts

A

False

368
Q

There is a cribl.log for the Leader Node and for the Worker Node

A

True

369
Q

(Select all that apply) What log files are in Cribl Stream?

A

-cribl.log
-access.log
-audit.log
-notifications.log

370
Q

Worker Node logs are created in

A

$CRIBL_HOME/log

371
Q

Access.log contains API calls

A

True

372
Q

Cribl.log will contain information on bundle deployments

A

True

373
Q

Worker Process logs are located in

A

$CRIBL_HOME/log/worker/[wp#]/

374
Q

Worker Nodes will log when they attempt to connect to the Leader Node

A

True

375
Q

There are logs for the Leader Node and the Worker Node

A

True

376
Q

Upgrading

Upgrade Sequence

A

-Single-Instance (upgrade the instance)
-Distributed Deployment: Upgrade the leader, then the Workers, Commit and Deploy

377
Q

Preparing for an Upgrade

A

-Default files will be overwritten (check for modifications and custom functions)
-Download package and checksum files if not using CDN

378
Q

Manual Upgrade

A

Step 1: Stop Stream
Step 2: Back up $CRIBL_HOME (optional)
Step 3: Uncompress new version over the old one
Step 4: Start Stream
Step 5: Validate your Stream environment

379
Q

Distributed Deployment Upgrade

A

Step 1: Commit and Deploy (git push to remote repo (optional))
Step 2: Upgrade the Leader (stop Stream, back up $CRIBL_HOME, uncompress new version over the old one, Start Stream
Step 3: Upgrade the Worker Nodes (wait for all the Workers to report to the leader, stop, uncompress new version over the old one, Start Stream)
Step 4: Commit new software version changes (ensure that all workers have reported with new version, commit & Deploy after verifying all workers are upgrade)

380
Q

Upgrading Leader Node through the UI

A

Stream Settings > System > Upgrade

381
Q

Cribl Cloud Upgrade: Cribl-Managed Cloud or Hybrid Deployment

A

-Cloud Leader and Workers will be automatically upgraded
-Disable Automatic upgrades only applies to customer-managed workers

382
Q

Upgrading Summary

A

-Upgrade is an install of a new version over the old
-You have the option of manual, UI, or automatic upgrade
-UI Upgrade of workers can be done separately for each worker grou
-You can control how each worker group is upgrade
-Cribl-managed cloud leader and workers upgrade automatically

383
Q

Worker Nodes will stop processing data while the leader is being upgraded

A

False

384
Q

During an upgrade, changes to default files will be

A

Overwritten

385
Q

If you are using a Cribl managed leader in a hybrid environment, all workers will be upgraded automatically

A

False

386
Q

Worker nodes will report to the leader if they are running a different version

A

True

387
Q

A possible upgrade sequence is:

A

Stop > Uncompress > Start

388
Q

For manual upgrade, you can decide to upgrade only a portion of your worker nodes at a given time

A

True

389
Q

If “disable automatic upgrades” is set to Yes, your cloud leader will not be upgraded

A

False

390
Q

(Select all that apply) Your options for Package source are

A

-Cribl CDN
-Local path on the server
-HTTP URL

391
Q

When performing an upgrade, on-prem work must be upgraded first

A

False

392
Q

(Select all that apply) UI upgrade allows for worker nodes to be

A

-Upgraded after the leader
-Automatically upgraded
-Upgraded by worker group

393
Q

Git

Without Local Git

A

-Single instance deployment can run without Git
-No change tracking or rollbacks
-Mandatory on the leader node for distributed deployments

394
Q

Local Git

A

-Track configuration changes
-Compare configuration versions
-Selective commits
-Restore previous configuration version

395
Q

Git

Things to keep in mind

A

-Make your repository private
-Use .gitignore to exclude wht gets pushed to Git

396
Q

Git Summary

A

Git
-Single-instance is option
-Distributed is mandatory
-Diff/Commit/Undo/Rollback

Setting up and using Git remote repository
-Make your repository private
-exclude large files

397
Q

Example Workflow with GitOps

A

1: Make changes in the Development system UI
2: Commit and push changes to remote repository (dev branch)
3: When ready to push changes into Production, create Pull request to move changes from the dev branch to the production branch
4: Merge Pull Request
5: Send notification to Stream to “sync” changes

398
Q

Setting up the Git Repo

A

-Follow instructions located at docs.cribl.io
-Set up remote git repo as normal on dev
-Push initial config from dev
-Create dev and prod branches

399
Q

Git Remote Respository Authentication

A

-Use secure protocols such as HTTPS or SSH
-HTTPS using username/password authentication
-SSH uses public/private keys
-Ensure your user accounts are only scoped for least priviledge acces

400
Q

Keys and Known hosts

A

-When using SSH, the private key is stored as $CRIBL_HOME/local/cribl/auth/ssh/git.key
-SSH uses a known_hosts file located at /home/cribl/.ssh/known_hosts
-Import server public keys using the following command (as the cribl user): ssh-keyscan -H <your-git-host.com> >> ~/.ssh/known_hosts</your-git-host.com>

401
Q

Git SSL Certificate Validation

A

-Git will validate SSL certificates when using HTTPS transport
-You should leave this validation enabled
-Self-signed or internal PKI will result in validation failure
-Import non-public CA signed certs for SSL validation

402
Q

Scheduled Commit and Push

A

-Stream allows for automatic commits and push to remote repository on a scheduled basis
-At a minimum you should set up automatic push
-you can find this configuration under Leader>Git Settings> Scheduled actions

403
Q

Excluding Files from the Git Repo

A

-Git can be problematic with large files
-Disable tracking of large lookups by adding files to the .gitignore file in $CRIBL_HOME
-Excluding SSL certificates managed by Stream may cause issues on workers
-Only add exclusions below the CUSTOM SECTION header

404
Q

Backing Up Everything

A

-Stream’s remote Git push is not a replacement for a comprehensive server backup strategy
-Items outside of $CRIBL_HOME are not tracked inside the Git repository
-Sync files to an S3 bucket for example

405
Q

Git Summary

A

-Use secure protocols for transport
-Protect authentication keys and use least privileged access
-Add certificates for SSL validation (if required)
-Set up a scheduled push to the remote repository
-Exclude large lookup files
-Git is not a comprensive backup strategy for the Leader node

406
Q

Stream Administrators should enable automatic GIT push on a scheduled basis

A

True

407
Q

Secure protocols should be used when setting up the remote repository

A

True

408
Q

Server validation is an important security measure and should be enabled

A

True

409
Q

Stream Administrators should store large lookups inside their GIT repository

A

False

410
Q

When using GIT SSH authentication, where does the known_hosts file reside?

A

$CRIBL_HOME/.ssh/known_hosts

411
Q

GIT back ups all server files

A

False

412
Q

GIT SSH keys or tokens should be able to access other respositories besides Stream

A

False

413
Q

Top Support Challenges

A
  1. Binding to a priviledge port
  2. Too many open files
  3. Out of memory
  4. Cloning workers
  5. resetting lost passwords
  6. pipeline profiling
414
Q

Support Challenges

Binding to a Privileged Port

A

-Stream should be running as a non root using
-If Cribl Stream is required to listen on ports 1-1024, it will need privileged access. You can enable this on systemd by adding this configuration key to your override.conf file: AmbientCapabilities=CAP_NET_BIND_SERVICE

415
Q
A
416
Q

Support Challenges

Too many open files

A

EMFILE too many open files
-When creating partitions avoid high cardinality fields in your expression
Raise the number of files
-For the following destinations, configure Max File options to avoid errors: Filesystem/NFS, Azure Blob, Google Cloud, Amazon S3
Increase Ulimit for Max Open Files (NOFILE)
-Edit systemd file to contain a line similar to the one here: LimitNOFILE=20248

417
Q

Support Challenges

Out of Memory

A

Out of Memory (OOM) errors are shown in the cribl_stderr.log file
Lookups
Aggregations

418
Q

Support Challenges

Cloning Workers

A

Worker GUID
-When you first install and run the software, Cribl Stream generate a GUID which it stores in a .dat file located in $CRIBL_HOME/local/cribl/auth
-When deploying Cribl Stream as part of a host image or VM, be sure to remove this.dat file, so that you do not end up with duplicate GUIDs. Cribl Stream will regenerate the file on the next run

419
Q
A
420
Q

Support Challenges

Resetting Lost Password

A

Cribl.secret file is located in $CRIBL_HOME/local/cribl/auth.cribl.secret

421
Q
A
422
Q

Support Challenges

Pipeline Profiling

A

blah blah blah

423
Q

Support Challenegs

Summary

A

Privileged Port Binding
-lower level port privleges
Too many open Files
-high cardinality path naming
Out of Memory
-Aggregations overloading memory
Cloning Workers
-Removal of DAT file containing the GUID
Lost Passwords
-Plaintext Password replacement in Users.json
Pipeline Profiling
-Helps with troubleshooting pipeline related issues

424
Q

(Select all that apply) What methods can be used to bind to privileged ports?

A

-Run as root (ONE IS WRONG)
-IPtables (ONE IS WRONG)
-Systemctl settings THIS IS CORRECT

425
Q

The default memory allocation for each worker is set to what value?

A

2GB

425
Q
A
426
Q

Stream User Passwords are stored in what file on disk?

A

$CRIBL_HOME/local/auth/users.json

427
Q

(Select all that apply) What things can cause a spike in the number of open files on a Stream Worker?

A

-High Cardinality Naming
-High number of incoming connections
-Large amount of persistent queuing

428
Q

(Select all that apply) What features consume memory in Cribl Stream?

A

Lookups and Aggregations

429
Q

Where does the Cribl Stream GUID live on a worker?

A

$CRIBL_HOME/local/cribl/auth/*.dat

430
Q

(Select all that apply) What settin controls the max number of open file processes on a Linux system?

A

-/proc/sys/fs/file-max
-systemd/system/cribl,service
-/etc/sysctl.conf
-/etc/security/limits.conf

431
Q

You can clone workers but make sure to remove the .dat file located in $CRIBL_HOME/local/cribl/auth

A

True

432
Q

(Select all that apply) What ports are considered privileged ports?

A

anything lower than 1024

433
Q
A
434
Q

Which of the following are responsibilities of a Worker?

A

-Run collector jobs
-Receives data from sources
-sends data to destinations
NOT backs up to Git (local only)

435
Q

Deploying a high performance single Stream instance is just as effective as using multiple workergroups.

A
436
Q

What are Cribl.Cloud allowed ports?

A

20000-20010

437
Q

A best practice when designing and planning is 200GB per vCPU @ 3GHz

A

True

438
Q

Which will impact system CPU requirements? (Select 3)

A

-Persistant Queuing
-Volume of data incoming?
number of destinations??? I think this answer is wrong
i think correct answer might be type of data processing required

439
Q

Which two choices are valid for Cribl Stream in Cribl.Cloud?

A

-Distributed Stream instance with Leader in Cribl.Cloud and Workers on prem
-Distributed Stream instance with Leader and workers in Cribl.Cloud

440
Q

How many Worker Nodes, each with 32vCPU, is needed to ingest 25TB and send out 15TB?

A

7 Worker Nodes

441
Q

Cribl Single Instance deployments supports which two of the following?

A

-Integration with Okta for Authentication
-GitHub Integration

442
Q

Which two protocols can be used for Worker Group to Worker Group communication? (Select 2)

A

Stream TCP and Stream HTTP

443
Q

Which of the following are advantages of a distributed deployment over a single instance? (Select 2)

A

Higher reliability
unlimited scalability

444
Q

Filter Expressions can be used in Functions to determine if that Function should be executed

A

True

445
Q

What is data being sent from Worker Group to Worker Group called?

A

Stream to Stream

446
Q

What are two use cases for routing data to Object Storage?

A

-Reducing Analytics tool or SIEM spend
-Replaying historical data for threat hunting exercise

447
Q

The Leader Node is required to send scheduled jobs to the Worker Nodes

A

True

448
Q

If you are using Elastic ingest Pipelines, specify an extra parameter whose name is Pipeline and whose value is:

A

the name of your pipeline

449
Q

What does Stream’s Elasticsearch destination support? (Select 2)

A

Splunk
Logstash
WRONG

450
Q

When configuring Splunk HEC, what setting should be turned on if the user want acks returned to the endpoint that is sending data?

A

Splunk HEC TLS (WRONG ANSWER)

451
Q

What is the most popular Elastic Beats used by Cribl Customers?

A

Filebeats and Winlogbeats

452
Q

What port does Splunk typically set its HEC collector on?

A

8088

453
Q

The user can install Packs using the CLI

A

True

454
Q

When backpressure behavior is set to drop events, backpressure causes outgoing events to get blocked

A
455
Q

When sending data to Elasticsearch Destination, Cribl recommends that _raw should be empty.

A

True

456
Q

What are sources called that data is collected from intermittently, either ad hoc or on a preset schedule?

A

Collectors

457
Q

What does capturing data within the Pipeline editor ensures?

A

Data is captured prior to sending to a destination

458
Q

Why is JSON a preferred option for Nested Field Serialization in a Splunk Destination?

A

Easier to report in Splunk (WRONG ANSWER)

459
Q

Which two are ideal use cases for an Output Router? (Select 2)

A

-Sending a full-fidelity copy of an event to S3 and a transformed copy of the event to Splunk
-Sending a filter of events to a Splunk instance, and a filter of other events to an Elastic Instance
ONE OF THESE IS WRONG

460
Q

How can you monitor the health of your Cribl Instances? (select 2)

A

-Setup a notification when destinations are unhealthy
-Poll the REST API to see if any pipelines are dropping events
WRONG ANSWER

461
Q

Which statement describes the discovery process for the S3 and file collectors?

A

Leader sends a request to the first available Worker node, Worker node sends a list of files back to the leader

462
Q

If no data is reaching the destination, which two things should a user do first within Cribl or on the Cribl systems? (Select 2)

A

-Netcat or wget from a worker to destination
-run a capture and select ‘before destination’ within Cribl

463
Q

Any changes made to a Knowledge Object will be preserved when updating the Pack.

A

False

464
Q

When writing data out to S3, which statement is true?

A

All files will remain open until timeout or max file size is reached

465
Q

When tuning settings for an S3 destination to avoid any ‘too many open files’ errors, decrease the number of max open files

A

False

466
Q

Which type of Encryption utilizes a public/private key pair?

A

Asymmetric

467
Q

A self signed certificate has a higher level of trust than a public CA signed certificate

A

False

468
Q

Audit.log contains changes to files

A

True

469
Q

What log files are in Cribl Stream? (Select all that apply)

A

cribl.log
notifications.log

Google Chronicle (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions