Cribl Security & Access Control Flashcards

Which Cribl feature allows you to define IP allowlists for restricting which hosts can send data to a specific input?

Answer: Network Access Control settings on the Source

Cribl inputs support network access control settings where administrators can define allowlists of permitted source IP addresses.

In Cribl Stream, which method is used to authenticate a Syslog source when mutual TLS (mTLS) is required?

Answer: Requiring client certificates on the TLS-enabled Syslog input

mTLS requires client certificate authentication configured on the TLS-enabled Syslog input to verify the identity of sending hosts.

What is the security benefit of using Cribl's 'Sandbox' execution mode for custom JavaScript functions?

Answer: It isolates custom code to prevent it from accessing the host system or other pipeline data

Sandbox mode in Cribl isolates custom JavaScript execution, preventing malicious or buggy code from accessing the host system or interfering with other pipelines.

When should Cribl's 'Redact' function be used instead of 'Mask' in a data pipeline?

Answer: When the sensitive value must be permanently removed rather than substituted with a pattern

The Redact function permanently removes a field's value, whereas Mask substitutes it with a pattern, making Redact the right choice when retention of any representation is not acceptable.

Which Cribl configuration controls the session timeout for inactive users in the web UI?

Answer: The Session Timeout setting under Security / Authentication settings

Cribl's Security/Authentication settings include a configurable session timeout that automatically logs out inactive users from the web UI.

What is the primary purpose of encrypting data at rest for Cribl's persistent queues?

Answer: To protect buffered events from being read if the underlying storage is compromised

Encrypting persistent queue data at rest ensures that buffered events cannot be accessed in plaintext if the storage medium is stolen or improperly accessed.