Edwin AI Cribl Integration

Use the LogicMonitor Edwin AI Cribl Integration to receive alert events in Edwin AI from your Cribl environment. This integration provides automated response, alert enrichment, and cross-platform incident correlation in real time using custom webhooks.

This integration supports structured JSON payloads using the Edwin Common Event Format (CEF) to enrich event data with test metrics, rule metadata, and more.

Requirements for Configuring Edwin AI Cribl Integration

To configure the Edwin AI Cribl Integration, you need the following:

• Access to the Worker Groups page in your Cribl account
• An Edwin AI Client ID and Client Secret. For more information, see Edwin AI API Credentials Management.

Configuring the Edwin AI Cribl Integration Webhook

1. Configure a webhook destination in Cribl.
   For more information, see Webhook Destination from Cribl.
2. On the General Settings page, configure the following settings:
   1. Add an Output ID.
   2. Toggle Load Balancing.
   3. In the Webhook LB URL field, enter https://<accountname>.dexda.ai/integration/event/v1 
   4. Select “Custom” from the Format dropdown.
   5. Expand Source expression and apply your custom payload template(See Custom Cribl Payload Template Example.)
3. On the Authentication page, configure the following:
   • Authentication Type—Basic
   • Username—Edwin API client ID
   • Password—Edwin API client secret

Once committed and deployed, Edwin will ingest the new webhook destination.

Custom Cribl Payload Template Example

A Custom Payload Template is required when creating a notification webhook in Cribl for Edwin AI to use.

The following payload example dynamically maps Cribl alert data to the Edwin AI CEF structure:

`${JSON.stringify([
  {
    cef: {
      eventCi: index || "",
      eventObject: source || "",
      eventName: _raw || "",
      eventDescription: _raw || "",
      eventDetails: "Host: " + (host || "") + ", SourceType: " + (sourcetype || ""),
      eventSeverity: 3,
      eventTimestamp: Math.round(((_time || Date.now() / 1000)) * 1000),
      eventSource: "Cribl",
      eventSourceIdLink: "https://criblshop.com",
      eventSourceId: "2399450",
      sourceRecord: __e || {},     // full event as JSON object
      class: "event",
      version: "1.1",
      eventDomain: ""
    },
    enrichments: {}
  }
])}`