CardinalOps (Cribl): scored, not profiled
Cribl announced on 2026-07-14 that it is acquiring CardinalOps, a detection engineering company, with terms undisclosed and no closing date stated. cardinalops.com now redirects to cribl.io and no product page under the CardinalOps name could be read, so the product no longer ships under its own name and this site does not profile it. cribl.io read 2026-11-04
CardinalOps (Cribl) is scored in the dataset and has no profile because acquired by Cribl (announced 2026-07-14); no longer ships under its own name. This note records what the public pages show and where it sits on the rubric.
The dataset still scores it 3.96 on the weighted rubric, with the evidence limit stated. Cribl's own Cribl Detect page documents ATT&CK posture management and flags broken or noisy rules; it does not mention CardinalOps, so the two are not treated as one product.
- Rubric total
- 3.96 of 10, twelfth of 14 scored
- Matrix score
- 3.5 of 33 (0 documented, 7 partial, 26 not documented)
- Ownership
- Acquired, Cribl. Cribl announced on 2026-07-14 that it is acquiring CardinalOps, an agentic detection engineering company. Terms were not disclosed in Cribl's release. The release does not state a closing date. cribl.io read 2026-11-03
Cribl announced the acquisition of CardinalOps on 2026-07-14; cardinalops.com returned a 301 redirect to cribl.io on 2026-11-03. The press release is at the Cribl newsroom. CardinalOps product documentation was not found; pages read are Cribl's press release, blog and solution brief.
What the product is described as
Detection engineering product from CardinalOps (acquired by Cribl in 2026) that maps SIEM detection rules to MITRE ATT&CK, finds coverage gaps, and finds broken or noisy rules. Per Cribl's release it now sits inside the Cribl platform; no separate product page remains. cribl.io read 2026-11-03 vendor claim
How CardinalOps (Cribl) scores on the rubric
The score reflects what a reader can find on public pages today, which for a product folded into another company is little. A low score here describes discoverability and not product quality.
CardinalOps (Cribl) on the eight rubric criteria. Part = weight times score over 100; the parts sum to the total.
| Criterion | Weight | Score | Status | Reason and source |
|---|---|---|---|---|
| Rule languages and conversion paths | 15 | 3.0 | not documented | cardinalops.com redirects to cribl.io; no rule language or SIEM support list is published under the CardinalOps name. cribl.io read 2026-11-04 |
| Git-native workflow and CI/CD | 18 | 3.0 | not documented | No git, CI or API documentation found after the redirect. cribl.io read 2026-11-04 |
| Testing | 15 | 3.0 | not documented | Cribl's release does not describe rule testing. cribl.io read 2026-11-04 |
| Coverage analytics | 12 | 7.0 | partial | Cribl's 2026-07-14 release says the product maps security controls against adversary behaviour to find and close coverage gaps (vendor claim, no method). vendor claim cribl.io read 2026-11-04 |
| Rule health | 18 | 6.0 | partial | Same release says it finds and fixes broken or noisy rules (vendor claim, no method or metrics). vendor claim cribl.io read 2026-11-04 |
| Versioning and rollback | 8 | 3.0 | not documented | Not documented. cribl.io read 2026-11-04 |
| Content library size and freshness | 8 | 3.0 | not documented | Not documented; Cribl Detect lists 8,000+ rule templates but that page does not mention CardinalOps. cribl.io read 2026-11-04 |
| Pricing transparency | 6 | 2.0 | not documented | No pricing page; terms of the deal were not disclosed. cribl.io read 2026-11-04 |
| Total, of 10 | 100 | 3.96 | Sum of the eight parts: 0.45 + 0.54 + 0.45 + 0.84 + 1.08 + 0.24 + 0.24 + 0.12 | |
What the public pages do not show
- cardinalops.com returns a 301 redirect to cribl.io on 2026-11-03. No standalone CardinalOps product page, pricing page, docs, changelog, newsroom or customers page was reachable.
- Closing date of the Cribl acquisition is not stated. The record uses status acquired because the deal is announced, but the release does not confirm completion.
- Deal value is not disclosed by either company. Press figure of about USD 100 million is conflicting and unconfirmed.
- No public customer list beyond Repsol, which appears only as a quote in Cribl's acquisition release.
- No pricing model or public price found.
- No standalone product page: cardinalops.com redirects to cribl.io, and archived CardinalOps pages were not reachable by Firecrawl. Coverage analytics and rule health features are known only from Cribl's release wording and the 2025 report release.
- Whether the product is sold on its own, and under what name, is not stated by Cribl on any page read.
- The latest report found is the 5th annual (2025); publication date conflicts (2025-03-04 on cribl.io, 2025-06-05 PR Newswire). The report PDF and its detailed method were not opened. No 2026 edition found.
- The 2024 figure (24 percent) is from trade press, not the report. The 2025 figure (21 percent) is from CardinalOps' release; neither tests whether the mapped rules fire.
- No analyst mentions and no release notes since 2025-11-01 were found.
Pricing as published for CardinalOps (Cribl)
No pricing page found. The redirected domain (cardinalops.com now resolves to cribl.io) shows no price, and the acquisition release gives no pricing model. cardinalops.com read 2026-11-03
Named customers of CardinalOps (Cribl)
Names below are as the source page lists them.
Customers named on public pages. Every name is a vendor claim from the page cited in its row.
| Customer | Source |
|---|---|
| Repsol | cribl.io read 2026-11-03 |
Recent releases and news for CardinalOps (Cribl)
- 2026-07-14 Cribl acquires CardinalOps to expand its AI platform into security operations. Cribl announced the acquisition, a Tel Aviv office, and that CardinalOps technology will be integrated into the Cribl platform. cribl.io read 2026-11-03
Claims CardinalOps (Cribl) makes about itself
Each figure is the vendor's. The evidence grade is defined on the rubric page: A measured by a third party with the method published, B vendor-measured with sample and method, C vendor figure with no method, D figure with no source.
Vendor claims with the evidence grade and who measured.
| Claim | Grade | Measured by | Source |
|---|---|---|---|
| Enterprise SIEMs have detection coverage for 24 percent of known MITRE ATT&CK techniques (fourth annual State of SIEM Detection Risk report, 2024 edition) vendor claim | C | vendor | hpcwire.com read 2026-11-03 |
| Enterprise SIEMs have detection coverage for 21 percent of MITRE ATT&CK techniques (79 percent uncovered), and 13 percent of SIEM rules are broken vendor claim | B | vendor | prnewswire.com read 2026-11-04 |
| SIEMs have enough telemetry to detect over 90 percent of MITRE ATT&CK techniques vendor claim | C | vendor | prnewswire.com read 2026-11-04 |
See the full ranking on the rubric page and the grid on the matrix.