Case Study: Yale New Haven Health reduces SIEM spend by 40% with Cribl

Yale New Haven Health cuts SIEM spend by 40% with Cribl

Yale New Haven Health, Connecticut's largest healthcare system, faced a challenge when a software update unexpectedly increased their Palo Alto firewall log volume by 30-45%, pushing them far over their 400 GB/day Splunk license. This increase, along with a costly Splunk upgrade, made their SIEM spend prohibitive. The cybersecurity team turned to the vendor Cribl and its product Cribl Stream to help manage data from over 30,000 endpoints and assist with a security tool migration.

Using Cribl Stream, the team easily stripped out unnecessary data from their logs, achieving a 40% reduction in Palo Alto log volume and bringing their Splunk usage back under their license limit. This control over their data allowed for a smooth, two-week transition from Splunk to Microsoft Sentinel. The solution provided by Cribl created a centralized location for all data, significantly cut storage costs, and gave the team the freedom to onboard new log sources without cost being a primary concern.

Yale New Haven Health