Where this offering fits
Cribl Lake is a telemetry-storage selection. Begin with retention, retrieval and the relationship to downstream analysis rather than treating stored data as an automatically searchable investigation system. The design should explain which records are kept, for how long and how authorised users regain access.
Architecture and rollout decisions
Map sources, storage volumes and retrieval use cases. Confirm the selected service, access controls and supported integrations. Pilot storing representative events and retrieving them through the intended workflow. Review data lifecycle, deletion and processing arrangements with the customer. The proposal should distinguish storage costs and entitlements from query, pipeline or other capabilities.
An evaluation scenario for this offering
Use a synthetic telemetry batch labelled with a test source and an agreed retention class. Follow it into the selected Lake storage arrangement, then retrieve a known event through the intended authorised consumer. Include a reviewer without access and confirm that retrieval follows the approved boundary. In a separate non-production lifecycle check, validate the documented treatment of data whose retention has expired without deleting live evidence. Keep ingest and retrieval records, timestamps, access results and the selected service configuration. The objective is a usable, governed retrieval path, not merely proof that some data occupies storage.
Evidence to request for this scope
- Define retention and approved data classes.
- Validate retrieval through the intended consumer.
- Confirm access, lifecycle and deletion behaviour.