Skip to main content

Cribl introduces AWS Security Hub extension for OCSF

Source Decision Insights Record Published December 2, 2025 Companies 2
Human View Machine View

2 companies named across 3 categories, one of 11 articles referencing Cribl. Previous coverage: Netskope details real-time SIEM integration for zero trust security (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Cloud Services

Our classification, not the publisher's statement. Best suited for, not only for.

Cribl introduced an enhanced extension for AWS Security Hub that converted security findings into the Open Cybersecurity Schema Framework (OCSF) and routed those findings to Cribl Lake for long-term retention, a change described as intended to help correlate threats and support incident response.

The release positioned the integration to work with AWS Security Hub’s centralized management of Security Operations (SecOps), enabling Security Hub events to be examined within Cribl Search alongside other security data and reducing the need to move between separate tools.

Cribl Stream added the dedicated extension for AWS Security Hub to collect findings, transform them into OCSF version 1.6 with AWS-specific resource details such as Amazon Resource Names, tags, and configuration attributes, and forward the normalized records to Cribl Lake or other destinations. The integration included EventBridge support to observe Security Hub findings and related AWS logs such as CloudTrail, and Cribl Search provided query capabilities over those events.

Cribl described the work as supporting aggregated security findings into a single view, enabling a standardized OCSF format with AWS context, and allowing correlation across telemetry systems; Cribl also noted that Cribl Copilot Editor used Artificial Intelligence (AI) to recommend mappings to OCSF, which reduced manual pipeline development. Cribl acted as a launch partner for the new AWS Security Hub, and the added capability in the AWS Security Hub extension in Cribl Stream was available today.

“The ultimate goal for every security team is fast, precise incident response. But you can't get there when your data is spread across multiple tools and does not give you real-time views into these events,”said Abby Strong, Chief Market and Customer Officer at Cribl. “By allowing users to query data stored in Cribl Lake, other object stores, and the Security Hub findings, security professionals can quickly correlate past incidents with real-time events.”

Press release, provided by Globe Newswire on behalf of Cribl. Read the original.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cribl-introduces-aws-security-hub-extension-for-ocsf/",
        "name": "Cribl introduces AWS Security Hub extension for OCSF",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cribl-introduces-aws-security-hub-extension-for-ocsf/#blogposting",
    "@type": "NewsArticle",
    "about": {
      "@id": "https://decisioninsights.ai/registry/cribl/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/cribl/",
      "name": "Cribl"
    },
    "articleSection": [
      "Cybersecurity",
      "Artificial Intelligence"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Cloud Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
      "@type": "Person",
      "name": "Decision Insights Record",
      "url": "https://decisioninsights.ai/author/decision-insights-signals/"
    },
    "dateModified": "2026-08-23T14:06:19-06:00",
    "datePublished": "2025-12-02T13:50:50-07:00",
    "description": "Cribl AWS Security Hub extension converts findings to OCSF and routes them to Cribl Lake for retention and query.",
    "headline": "Cribl introduces AWS Security Hub extension for OCSF",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@type": "Organization",
        "name": "GlobeNewswire"
      },
      "url": "https://www.globenewswire.com/news-release/2025/12/02/3198404/0/en/Cribl-Supercharges-Incident-Response-in-Amazon-Security-Hub-with-Open-Cybersecurity-Schema-Framework-OCSF-Support.html"
    },
    "keywords": [
      "Incident Response"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cribl-introduces-aws-security-hub-extension-for-ocsf/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/amazon.com/amazon-web-services-aws/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/amazon.com/amazon-web-services-aws/",
        "name": "Amazon Web Services (AWS)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/cribl/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/cribl/",
        "name": "Cribl"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
    "@type": "Person",
    "description": "Press releases and independent analyst research, structured into concise summaries for research and monitoring. Produced under our Standards & Methodology.",
    "name": "Decision Insights Record",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-signals/"
  }
]

Is this your company? Get structured data for your own pages