What do Cribl and Microsoft sell?

Cribl sells Cribl Search, Cribl Lake, Cribl Edge, Cribl Guard, Cribl Packs and 2 more. Microsoft sells Microsoft Defender, Microsoft Sentinel, Microsoft Purview, Microsoft Entra, Microsoft Intune and 3 more.

Are Cribl and Microsoft in the same category?

They share SIEM. Cribl's primary category is Security data lakes and pipelines and Microsoft's is EDR and XDR.

Where are Cribl and Microsoft headquartered?

Cribl is headquartered in San Francisco, United States. Microsoft is headquartered in Redmond, United States.

When were Cribl and Microsoft founded?

Cribl was founded in 2018. Microsoft was founded in 1975.

Who owns Cribl and Microsoft?

Cribl is privately held. Microsoft is a public company listed on NASDAQ as MSFT.

Which customers do Cribl and Microsoft name?

Microsoft publicly names Best Buy, Danfoss and Oregon State University.

Who are Cribl and Microsoft sold to?

From its own pages, Cribl sells mainly to IT and security teams at many of the world's largest enterprises. From its own pages, Microsoft sells security products for businesses of any size.

What have Cribl and Microsoft announced recently?

September 29, 2026: Cribl introduced Cribl Detect, a SIEM built on its open data platform, claimed to cost up to 50% less than other companies. July 29, 2026: Microsoft reported revenue of $90.0 billion for the quarter ended June 30, 2026, up 18% year over year.

Vendor comparison · 2 companies

Cribl vs Microsoft

Cribl sells the AI Platform for Telemetry to IT and security teams. Microsoft Defender offers threat prevention, detection and response capabilities. CISO Tribune files both under SIEM. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

Cribl
Microsoft

Add a company

Cribl vs Microsoft: Products, Customers and Funding Compared
What it sells
	CriblCribl sells the AI Platform for Telemetry to IT and security teams.cribl.io	MicrosoftMicrosoft Defender offers threat prevention, detection and response capabilities.microsoft.com
What it sells	Cribl SearchCribl Search searches data in place across data lakes, object stores, analytics services, and API endpoints. Cribl Lake^[2][9]Cribl Lake receives data that is less likely to be frequently used. Cribl EdgeCribl Edge is a vendor-neutral agent for endpoint data collection. Cribl GuardCribl Guard uses AI to spot sensitive data as it flows through Cribl Stream. Cribl PacksCribl Packs are bundles that package data routes, pipelines, and configurations. Cribl Detect^[4][15]Cribl Detect is offered as a SIEM. Cribl as Code^[7]Cribl as Code gives teams programmatic control to automate, configure, and manage their Cribl environment.	Microsoft Defender^{[1][11][12][23][25]}Threat protection that prevents, detects and responds to attacks across devices, identities, applications, email, data, workloads and cloud environments. Microsoft Sentinel^[1][23]A cloud-native SIEM built for AI. Microsoft Purview^{[1][14][23][24][25]}Unified information protection, governance and compliance products. Microsoft Entra^{[1][15][23][25]}Identity and access products that verify every identity and access request across clouds, platforms and devices. Microsoft Intune^{[1][16][23][25]}Endpoint management products for device security and hybrid work. Microsoft Defender Suite^[12]Threat protection and detection and response across endpoints, identities, email and SaaS apps. Microsoft Entra Suite^[15]An extension to Microsoft 365 E3 or E5 for secure workforce use of apps and AI. Microsoft Purview Suite^[14]A suite that provides advanced data security and compliance capabilities.
Categories
Categories	Security data lakes and pipelines (primary category) SIEM	EDR and XDR (primary category) SIEM Workforce IAM and SSO Endpoint management and application control
Headquarters
Headquarters	San Francisco, United States	Redmond, United States^[3]
Founded
Founded	2018^[3]	1975^[2]
Ownership and funding
Ownership and funding	Privately held^[5][14]	Public (NASDAQ: MSFT)^[4][10][22]
Named customers
Named customers	Not stated on its pages	Best Buy^[5] Danfoss^[6] Oregon State University^[7]
Recent news
Recent news	September 29, 2026Cribl introduced Cribl Detect, a SIEM built on its open data platform, claimed to cost up to 50% less than other companies.^[15] August 19, 2026Cribl acquired technology assets from Radiant Security's AI-native security operations center product, including intellectual property for autonomously triaging and investigating security alerts.^[14]	July 29, 2026Microsoft reported revenue of $90.0 billion for the quarter ended June 30, 2026, up 18% year over year.^[8] July 27, 2026Microsoft introduced Project Perception, an agentic security system that uses AI to turn signals into real-time protections.^[21] May 1, 2026Microsoft announced general availability of Microsoft 365 E7 and Microsoft Agent 365 on May 1, 2026.^[28] April 29, 2026Microsoft reported revenue of $82.9 billion for the quarter ended March 31, 2026, up 18% from a year earlier.^[9] December 22, 2025Microsoft announced the Defender Experts suite, an expert-led security offering for resellers and scale solution providers, generally available from January 1, 2026.^[20]
G2 and Gartner Peer Insights
G2 and Gartner Peer Insights	G2: Not stated on its pages Gartner Peer Insights: Not stated on its pages	G2: listed, seen November 10, 2026^[10] Gartner Peer Insights: Not stated on its pages
Who it fits
Who it fits	From its own pages, Cribl sells mainly to IT and security teams at many of the world's largest enterprises. Its pages describe SREs, devs, and security teams who collect once and search anywhere. Cribl offers a consumption-based model on its cloud platform and volume-based licensing for customers who run their own infrastructure.	From its own pages, Microsoft sells security products for businesses of any size. Microsoft 365 Business Premium is aimed at small and medium-sized businesses, and Microsoft Defender is designed to protect individuals, businesses and enterprises. Microsoft refers to enterprise and government cloud customers, and Providence Care, a healthcare organization, uses Microsoft 365 E5 for healthcare security.
Last verified
Last verified	September 27, 2026	November 2, 2026

Where they overlap

Cribl and Microsoft are both filed under SIEM.
Both are headquartered in the United States.

Where they differ, field by field

Cribl's primary category is Security data lakes and pipelines; Microsoft's is EDR and XDR.
Microsoft is also filed under Workforce IAM and SSO and Endpoint management and application control.
Cribl lists Cribl Search, Cribl Lake, Cribl Edge, Cribl Guard, Cribl Packs and 2 more. Microsoft lists Microsoft Defender, Microsoft Sentinel, Microsoft Purview, Microsoft Entra, Microsoft Intune and 3 more.
Cribl is headquartered in San Francisco, United States. Microsoft is headquartered in Redmond, United States.
Cribl was founded in 2018. Microsoft was founded in 1975.
Cribl is privately held. Microsoft is a public company listed on NASDAQ as MSFT.
Microsoft publicly names Best Buy, Danfoss and Oregon State University.

What it sells: Cribl

What Cribl Search does: Cribl Search is powered by a federated engine that searches data at rest and a lakehouse engine that searches data as soon as it is ingested. Cribl Search includes collaborative Notebooks and AI-assisted KQL query generation. Cribl Search is a standalone offering.
What Cribl Guard does: Cribl Guard spots data like credit cards or social security numbers. Human-in-the-loop review lets operators approve or override actions before data is masked or blocked.

What it sells: Microsoft

What Microsoft Defender does^{[1][11][12][23][25]}: Microsoft Defender is a threat protection solution designed to protect individuals, businesses and enterprises from malicious cyberthreats. Microsoft Defender coordinates protection across endpoints, identity, email, apps and cloud.
What Microsoft Purview does^{[1][14][23][24][25]}: Microsoft Purview offers a unified approach to help organizations secure and govern data across their heterogenous data estate. Microsoft Purview covers on-premises, multicloud and SaaS environments, and structured and unstructured data. Microsoft Purview features are purchased through different licenses or on a pay-as-you-go basis.
What Microsoft Entra does^{[1][15][23][25]}: Azure Active Directory (Azure AD) was renamed Microsoft Entra ID in 2023. Purchase starts with Microsoft Entra ID P1 or P2 license subscriptions, which can also be purchased as part of a Microsoft 365 E3 or E5 license.
What Microsoft Intune does^{[1][16][23][25]}: Microsoft Intune offers advanced endpoint management and security capabilities available as standalone add-ons or as part of the Intune Suite. Microsoft Intune Plan 1 is the endpoint management solution included in most Microsoft 365 enterprise licenses. Plan 1 covers cross-platform device management, built-in security, mobile application management and endpoint analytics.
What Microsoft Defender Suite does^[12]: Microsoft Defender Suite focuses on threat protection and detection and response across endpoints, identities, email and SaaS apps. The integrated security operations center (ISOC) is included in the Defender Suite.
What Microsoft Entra Suite does^[15]: Microsoft Entra Suite extends Microsoft 365 E3 or E5 to enable secure workforce use of apps and AI with continuous, adaptive identity and network access controls across employees, apps and networks. Microsoft Entra Suite requires a subscription to Microsoft Entra ID P1 or a package that includes Microsoft Entra ID P1.

Questions about Cribl and Microsoft

What do Cribl and Microsoft sell?: Cribl sells Cribl Search, Cribl Lake, Cribl Edge, Cribl Guard, Cribl Packs and 2 more. Microsoft sells Microsoft Defender, Microsoft Sentinel, Microsoft Purview, Microsoft Entra, Microsoft Intune and 3 more.
Are Cribl and Microsoft in the same category?: They share SIEM. Cribl's primary category is Security data lakes and pipelines and Microsoft's is EDR and XDR.
Where are Cribl and Microsoft headquartered?: Cribl is headquartered in San Francisco, United States. Microsoft is headquartered in Redmond, United States.
When were Cribl and Microsoft founded?: Cribl was founded in 2018. Microsoft was founded in 1975.
Who owns Cribl and Microsoft?: Cribl is privately held. Microsoft is a public company listed on NASDAQ as MSFT.
Which customers do Cribl and Microsoft name?: Microsoft publicly names Best Buy, Danfoss and Oregon State University.
Who are Cribl and Microsoft sold to?: From its own pages, Cribl sells mainly to IT and security teams at many of the world's largest enterprises. From its own pages, Microsoft sells security products for businesses of any size.
What have Cribl and Microsoft announced recently?: September 29, 2026: Cribl introduced Cribl Detect, a SIEM built on its open data platform, claimed to cost up to 50% less than other companies. July 29, 2026: Microsoft reported revenue of $90.0 billion for the quarter ended June 30, 2026, up 18% year over year.

About Cribl

Cribl sells the AI Platform for Telemetry to IT and security teams. Cribl says it was founded to address a problem in which telemetry was exploding while the tools to manage and search it were rigid, expensive, and siloed. Cribl started by giving customers a way to route and shape telemetry, so they could keep more data and send it to the right places. Cribl describes its platform as vendor-agnostic, with a telemetry engine to automate investigations. Cribl says telemetry data continues to grow at 28% a year and logging systems are at capacity. Cribl says its platform turns telemetry into a shared, reusable foundation for IT, security, and AI-driven operations.^{[4][6][7][10][11]}

Cribl Stream integrates with 80+ sources and destinations, and portable Packs move entire pipelines as reusable bundles. Cribl Packs are bundles that package data routes, pipelines, and configurations. Collectors are fully supported in Cribl Packs for managing and shipping data from cloud, databases, and APIs. Copilot Editor in Cribl Stream maps schemas, transforms data, and filters data from plain language prompts.^[1][7]

Cribl Stream offers dynamic sampling to filter events or roll up logs into metrics. Cribl Stream can keep a full-fidelity copy in low-cost storage or a data lake and replay it later. Cribl Guard uses AI to spot sensitive data, like credit cards or social security numbers, as it flows through Cribl Stream. Cribl Guard includes human-in-the-loop review, so operators can approve or override actions before data is masked or blocked. Cribl as Code gives security, IT, and engineering teams programmatic control to automate, configure, and manage their Cribl environment.^[7][11]

Cribl Edge is a vendor-neutral agent for endpoint data collection. Cribl Edge is an agent for file monitoring, upgrades, and configurations that are managed through a GUI. Cribl Lake receives data that is less likely to be frequently used. Cribl Lake and Cribl Search are used for lower-cost retention and in-place search. Cribl Search is powered by a federated engine that searches data at rest and a lakehouse engine that searches data as soon as it is ingested. Cribl Search is a standalone offering, so Cribl Stream is not required to use it.^[8][9][10]

Cribl Search searches data in place and supports data lakes, object stores, analytics services, API endpoints, and more. Cribl Search includes AI-guided incident investigations, collaborative Notebooks, AI-assisted KQL query generation, reporting, and visualizations.

Cribl Detect is offered as a SIEM. Cribl describes its SIEM approach as decoupling analysis from storage. Cribl Copilot Editor helps create pipelines using natural language to accelerate migration to new SIEMs and storage locations. Cribl Stream adds context to security data sources, like GeoIP, indicators of compromise, and any other threat intelligence database. Cribl supports storing data in low-cost object storage and replaying it to any destination for incident response. Cribl says most organizations route all telemetry, logs, metrics, and traces, into a single costly tier. Cribl supports routing frequently used data to SIEMs and observability tools, less-used data to a lakehouse, and data to an archive tier for retention requirements. Cribl supports delivering log management as a governed, multi-tenant shared service.^{[4][9][10][11]}

Cribl offers a consumption-based model on its cloud platform, where Cribl Credits let customers allocate spending as demands change. Cribl offers volume-based licensing for Stream and Edge for customers who run their own infrastructure. Cribl offers multiple editions of its product suite. Enterprise customers get up to 3 Workspaces included for free, and additional Workspaces cost 250 credits per Workspace per month. FinOps Center tracks changes in data usage over time and ties them to events such as onboarding new sources or infrastructure shifts. Cribl Consulting Services provides advisory, delivery, optimization, and enablement work across a customer's Cribl environment, purchased through Service Credits.^[12][13]

Cribl was formed in San Francisco, California. Cribl completed a Series A with $7.4M in funding and a Series B with $35M raised, led by Sequoia Capital. Cribl announced a Series C with $200M led by Greylock and Redpoint Ventures. Cribl secured $150M in Series D funding led by Tiger Global Management. Cribl closed a $319 million Series E at a $3.5 billion valuation. Cribl acquired CardinalOps to expand its AI platform into security operations. Cribl achieved FedRAMP Authority to Operate for U.S. federal government agencies.^{[2][4][7][10][12]}

Cribl on the record

About Microsoft

Microsoft Defender offers threat prevention, detection and response capabilities. Microsoft Defender coordinates protection across endpoints, identity, email, apps and cloud. Security Copilot agents come ready to use in Microsoft Entra, Microsoft Intune, Microsoft Purview, Microsoft Defender and Microsoft Sentinel.^{[11][15][16][23]}

Microsoft Defender is a threat protection solution designed to protect individuals, businesses and enterprises from malicious cyberthreats. Microsoft Defender has the purpose of preventing, detecting and responding to attacks across devices, identities, applications, email, data, workloads and cloud environments. XDR capabilities are included with eligible Microsoft plans and supported Defender products. Microsoft offers cloud security for hybrid and multicloud environments across the full application lifecycle, from code to runtime. Microsoft offers vulnerability management with continuous vulnerability assessment, risk-based prioritization and remediation. Microsoft offers email and collaboration security against phishing and advanced cyberthreats such as business email compromise.^{[1][11][12][17][26][27]}

Microsoft Defender Suite focuses on threat protection and detection and response across endpoints, identities, email and SaaS apps. The integrated security operations center (ISOC) is included in the Defender Suite. Microsoft Defender Suite is offered on its own or as part of Microsoft 365 E5. Microsoft Defender for Endpoint licenses include protection for up to 5 devices per user license. Microsoft Defender for Office 365 protects against email-based threats and secures collaboration tools including Microsoft Teams, SharePoint and OneDrive. Microsoft offers expert-led services to help defend against threats, build cyber resilience and modernize security operations. Microsoft offers AI-powered threat hunting across endpoints, identities, emails, cloud apps and cloud workloads.^{[1][11][12][14][19]}

Microsoft offers a cloud-native SIEM built for AI. The cloud-native SIEM from Microsoft includes a built-in data lake. Azure Active Directory (Azure AD) was renamed Microsoft Entra ID in 2023. To purchase Microsoft Entra, customers start with Microsoft Entra ID P1 or P2 license subscriptions, which can also be purchased as part of a Microsoft 365 E3 or E5 license. Microsoft Entra Suite extends Microsoft 365 E3 or E5 to enable secure workforce use of apps and AI with continuous, adaptive identity and network access controls across employees, apps and networks. Microsoft Entra Suite requires a subscription to Microsoft Entra ID P1 or a package that includes Microsoft Entra ID P1. Identity Governance enforces least privilege access and automates access lifecycles.^{[1][12][15][23]}

Microsoft Intune offers advanced endpoint management and security capabilities available as standalone add-ons or as part of the Intune Suite. The advanced capabilities include Endpoint Privilege Management (EPM), Enterprise App Management (EAM), Advanced Analytics, Remote Help, Microsoft Cloud PKI, Microsoft Tunnel for Mobile Application Management (MAM), Firmware-over-the-Air (FOTA) updates and Specialized Device Management. Microsoft Intune Plan 1 is the endpoint management solution included in most Microsoft 365 enterprise licenses, covering cross-platform device management, built-in security, mobile application management and endpoint analytics. Select advanced Intune capabilities are now included in Microsoft 365 E3 and E5.^[1][16]

Microsoft Purview offers a unified approach to help organizations secure and govern data across their heterogenous data estate. Microsoft Purview enables organizations to secure and govern a data estate across on-premises, multicloud and SaaS environments, and across structured and unstructured data. Microsoft offers data security to discover, classify and protect sensitive data across a data estate. Microsoft Purview features are purchased through different licenses or on a pay-as-you-go basis. Microsoft Purview Suite (formerly Microsoft E5 Compliance Suite) provides advanced data security and compliance capabilities. Microsoft 365 E5 includes Office apps, identity and endpoint protection, and all Microsoft Purview Suite capabilities.^{[1][13][14][24]}

Microsoft 365 Business Premium is a solution for small and medium-sized businesses. Microsoft 365 Business Premium includes Microsoft Defender for Business, Microsoft Defender for Office 365 Plan 1, Microsoft Entra ID Plan 1, Microsoft Intune Plan 1 and Microsoft Purview, along with Outlook, Word, Excel, PowerPoint, Teams, SharePoint, Clipchamp and Copilot Chat. Microsoft points organizations with more than 300 users to its enterprise offerings. Ford Motor Company uses Microsoft Security solutions to protect its data and operations. Providence Care uses Microsoft 365 E5 for healthcare security. Auckland Transport uses Microsoft Security Copilot for citywide cybersecurity. KPMG deployed Microsoft Defender for Cloud and Microsoft Purview for sensitive data that might be exfiltrated or overshared by AI apps.^{[1][12][13][14][15][17][18][25][26]}

Microsoft on the record

Sources

Cribl full record

[1]StreamCribl · cribl.io · undated page, accessed September 27, 2026 · Tier A
[2]cribl.ioCribl · cribl.io · undated page, accessed September 27, 2026 · Tier A
[3]Cribl announces 319m series eCribl · cribl.io · published August 27, 2024 · Tier A
[4]The AI Platform for Telemetry | CriblCribl · undated page, accessed October 27, 2026 · Tier A
[5]About Cribl | CriblCribl · undated page, accessed November 10, 2026 · Tier A
[6]Data Optimization Initiative | CriblCribl · undated page, accessed November 10, 2026 · Tier A
[7]Cribl Stream - Simplify Data Collection, Control, & Routing | CriblCribl · undated page, accessed November 10, 2026 · Tier A
[8]Consolidate Multiple Legacy Agents to Save Resources | CriblCribl · undated page, accessed November 10, 2026 · Tier A
[9]Cribl data tiering solution: boost telemetry value & speed | CriblCribl · undated page, accessed November 10, 2026 · Tier A
[10]Cribl Search - Faster Log Investigations Without SIEM Costs or Complexity | CriblCribl · undated page, accessed November 10, 2026 · Tier A
[11]SIEM Migrations Made Easier with Cribl | CriblCribl · undated page, accessed November 10, 2026 · Tier A
[12]Cribl Pricing Plans | CriblCribl · undated page, accessed November 10, 2026 · Tier A
[13]Cribl Service Credits | CriblCribl · undated page, accessed November 10, 2026 · Tier A
[14]Cribl Advances AI-Powered Security Operations with New AI SOC AcquisitionCribl · published August 19, 2026 · Tier A
[15]Introducing Cribl Detect, Delivering a New Way to SIEMCribl · published September 29, 2026 · Tier A

Microsoft full record

[1]Cloud Security Solutions | Microsoft SecurityMicrosoft · undated page, accessed September 27, 2026 · Tier A
[2]AboutMicrosoft · news.microsoft.com · undated page, accessed September 27, 2026 · Tier A
[3]Msft 20240630Microsoft Corporation via SEC EDGAR · sec.gov · undated page, accessed September 27, 2026 · Tier A
[4]7c96b326 33bc 4b84 8abb 7afd7a517ea3Microsoft Corporation · microsoft.gcs-web.com · undated page, accessed September 27, 2026 · Tier A
[5]25053 best buy microsoft sentinelMicrosoft · microsoft.com · published August 25, 2025 · Tier A
[6]22786 danfoss microsoft sentinelMicrosoft · microsoft.com · published March 7, 2025 · Tier A
[7]1747330384796486050 oregon state university microsoft security copilot higher education en united statesMicrosoft · microsoft.com · published March 14, 2024 · Tier A
[8]Microsoft cloud and ai strength fuels fourth quarter results 4Microsoft · news.microsoft.com · published July 29, 2026 · Tier A
[9]Microsoft cloud and ai strength fuels third quarter resultsMicrosoft · news.microsoft.com · published April 29, 2026 · Tier A
[10]Microsoft 365 Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 26, 2026 · Tier C
[11]Microsoft Defender—Cybersecurity Solutions | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
[12]Microsoft Defender Suite | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
[13]Microsoft Purview Suite | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
[14]Microsoft Purview Pricing | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
[15]Microsoft Entra Pricing | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
[16]Microsoft Intune Pricing | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
[17]Cybersecurity for small and medium business | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
[18]Security Copilot agents in Microsoft 365 E5 | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
[19]Microsoft Defender Pricing | Microsoft SecurityMicrosoft · undated page, accessed November 3, 2026 · Tier A
[20]December 2025 announcements - Partner Center announcementsMicrosoft Learn · published December 22, 2025 · Tier A
[21]Rethinking security for the age of AIThe Official Microsoft Blog · published July 27, 2026 · Tier A
[22]Microsoft Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed November 3, 2026 · Tier C
[23]Microsoft 365 Security Enterprise Plans| Microsoft SecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
[24]Microsoft Purview: Data Security and Governance | Microsoft SecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
[25]CybersecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
[26]Microsoft Defender Suite for Microsoft 365 Business Premium | Microsoft SecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
[27]Microsoft Mobile Phone Authenticator | Microsoft SecurityMicrosoft · undated page, accessed November 10, 2026 · Tier A
[28]Leading Frontier Firm transformation with Microsoft 365 E7: The partner opportunityMicrosoft · published May 1, 2026 · Tier A

Spot a factual error? Request a correction.