Skip to content

Integrating SailPoint with Cribl Stream

Cribl Stream is a vendor-agnostic observability pipeline that enables organizations to collect, reduce, enrich, normalize, and route data from any source to any destination within their existing data infrastructure. It helps IT and security teams optimize data flows, lower costs, and streamline overall data management.

This document provides instructions to configure a new direct connection between SailPoint and Cribl Stream. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Cribl Stream connector supports the following:

Account Management

  • Aggregate Accounts

Entitlement Management

  • Aggregate Entitlements

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Ensure the following prerequisites are met before proceeding with the configuration:

  • Access to a Cribl Stream environment on Cribl.Cloud.
  • An API Credential must be created in Cribl.Cloud:
    1. Log in to Cribl.Cloud as an Owner or Admin.
    2. From the top navigation, select Products > Cribl Stream.
    3. In the left sidebar, go to Organization > API Credentials, and then select Add Credential.
    4. Enter a Name and optional Description.
    5. Under Organization Permissions, choose the appropriate Role. The API Credential must have either Admin or Owner role in Cribl Stream. This provides sufficient access to read Users (for account aggregation) and Roles (for entitlement aggregation).
    6. Select Save.
  • The API Credential provides a Client ID and Client Secret.
  • These credentials must be used with the OAuth2 Client Credentials flow to generate a Bearer token for authenticating API requests to Cribl Stream.

Required Permissions

The API Credential must have either Admin or Owner role in Cribl Stream. This provides sufficient access to read Users (for account aggregation) and Roles (for entitlement aggregation).

Resource Link

For detailed information, refer to the Cribl API Documentation.