Cribl Detect vs Dropzone AI
Cribl Detect is the SIEM on Cribl’s product page: in-stream detections, posture management, federated search, and AI triage. Dropzone AI is the AI SOC Analyst that investigates alerts in the tools you already run, capped at 4,000 full investigations per year per analyst.
Cribl acquired Radiant Security’s AI SOC technology assets on 19 Aug 2026. The name on Cribl’s current product page is Cribl Detect, a SIEM, not a standalone Radiant subscription.
Cribl Detect generates signals in the pipeline before storage, chains them into correlations, ships more than 8,000 detection templates, and maps coverage to MITRE ATT&CK. Search can run across Cribl, another lake or object store, or another SIEM. Dropzone’s pricing page meters the other job: up to 4,000 full investigations per year per AI analyst, unlimited users, and pre-built integrations with SIEM, SOAR, and EDR. Broader AI SOC shortlists sit on AI SOC tools. SOAR versus investigation is Tines vs Dropzone AI.
| Job | SIEM on the Cribl platform: streaming detection, correlation, detection posture, federated search, AI triage, handoff to ITSM or SOAR | AI SOC Analyst that investigates alerts through connected tools. Threat Hunter is marked beta on the Agentic SOC post. Threat Intel Analyst is marked planned for Summer 2026 on that post |
|---|---|---|
| What closes the work | Related signals grouped into one alert, enriched with threat intel, investigated with a natural-language copilot, saved in a notebook, then pushed to the ticketing or SOAR tool you already use | An investigation report with each tool query and reasoning step visible. Containment only if you authorize it. Follow-up questions go to the chatbot |
| Deploy | On Cribl telemetry. Can run beside the SIEM you already have, or with the Cribl platform as the SIEM | SaaS agents against your SIEM, SOAR, and EDR. Enterprise is a dedicated single-tenant environment. MSSP is dedicated multi-tenant |
| Public price | A currency, unit, period, commitment, and included product for Cribl Detect: not found in this research | No dollar on the pricing page. Unit is one AI analyst, up to 4,000 full investigations per year. Enterprise and MSSP are contact pricing |
| Who runs it | Detection engineers and SOC analysts on a Cribl telemetry program | SOC leads who set alert scope, tool access, and whether an agent may contain |
That sentence is a customer claim about Threat Hunter. The same post still marks Threat Hunter as beta and still marks the Threat Intel Analyst as planned for Summer 2026. It is not a measured time for the AI SOC Analyst’s alert investigations, and it is not a Cribl Detect number.
Radiant Security
Dropzone AI
Editions and pricing
Dropzone publishes the capacity unit and what it includes. Cribl Detect’s product page describes the SIEM and does not publish a price. The “$36K” label on Dropzone’s pricing-page ROI calculator is an equivalent-headcount widget, not a stated subscription.
| How you buy it | Cribl Detect with the Cribl platform. A public rate card: not found in this research | Capacity subscription. Enterprise and MSSP pricing are contact-only |
|---|---|---|
| Unit | Not found in this research | One AI analyst. Up to 4,000 full investigations per year. Unlimited human users. More capacity is a separate purchase after an email grace window. Volume discounts are named |
| Included with that unit | Not found in this research. The product page lists detection, posture, search, triage, and response integrations as product capabilities, not as a priced bundle | All available alert categories, pre-built SIEM, SOAR, and EDR integrations, threat-intel feeds including CrowdStrike Falcon Intelligence, IPInfo, and AbuseIPDB, the AI chatbot, engineer access, and an 8-hour customer-support SLA |
| Tenancy | Cribl.Cloud customers are the audience on the Detect launch. Isolation options on a public price sheet: not found in this research | Enterprise: dedicated single-tenant compute and storage. MSSP: dedicated multi-tenant, with analyst capacity pooled across customers |
How an investigation starts
| First signal | Streaming detections in the pipeline, before a storage decision. Correlations chain those signals. More than 8,000 rule templates. Sigma import and assisted query translation | Alerts already raised in a connected SIEM, EDR, or SOAR. No playbook is required for the analyst agent to investigate |
|---|---|---|
| Coverage view | Detection posture management: MITRE ATT&CK map, broken or noisy rules, missing telemetry, and a recommended gap to close | You choose which alert types the agents investigate. A MITRE coverage map of your detection rules: not found in this research |
| Query shape | OCSF on write. KQL for queries. Natural-language copilot. Federated search across Cribl, other lakes and object stores, or other SIEMs, without rehydration | The agent queries connected tools and shows each step. Threat Hunter, still marked beta, runs hypothesis hunts across SIEM, EDR, and cloud tools, with 250 or more pre-built hunt packs on the Agentic SOC post |
| Schema lock-in | Detect says pipeline, schema, response, and investigation are each optional Cribl-native pieces, and that you can keep another SIEM | Dropzone does not replace the SIEM. It uses the tools you connect |
Investigation output
| Artifact | One alert view of related signals, threat-intel enrichment, a notebook of the search, and AI triage that is supposed to surface genuine threats | Decision-ready investigation report. Every tool queried and every reasoning step is part of the product claim. Chatbot for a follow-up question |
|---|---|---|
| Human role | Analysts use the copilot and then push the alert into the workflow they already have. A named confirm-or-override gate on every verdict: not found in this research | You set scope, authorization, and context. Dropzone says the agents are software only, with no hidden human reviewer in the investigation path. Containment stays behind your authorization |
| Response | Notifications, ITSM, and SOAR integrations. Detect lists response as one composable piece, not a mandatory rip-and-replace of SOAR | Outcomes can go back to SOAR or a case tool. Scoped containment when you allow it. That is not the same as a playbook product. See Dropzone AI vs Prophet Security for another investigation-agent pair |
Where they overlap
Both apply AI to alert work, both can hand a result to a SOAR or ticketing tool you already run, and both describe a human who still sets direction. Detect also owns detection content, posture, and search. Dropzone also owns a metered investigation and, in beta, a hunt agent. An RFP that only says “AI SOC” will get both demos. They overlap on triage and investigation. They do not overlap on who stores the detection rule.
When to use both
Both can be in one program when Cribl Detect is producing detections and Dropzone is investigating alerts that still live in another SIEM or EDR. Both on the same alert stream, each writing its own verdict, is two queues. If Detect is the SIEM of record, ask whether its AI triage and notebook already cover the investigation you would meter at 4,000 per analyst per year.
The purchasable Cribl name is Cribl Detect. Dropzone remains an independent product with a published investigation cap and no public dollar on its pricing page. Confirm tenancy and overage on the Dropzone quote, and confirm Detect’s price on the Cribl quote.
FAQs
What name is on the Cribl quote?
Cribl Detect, the SIEM on cribl.io/products/detect.
Does Dropzone replace a SIEM or a SOAR?
Not on the pages checked. Dropzone investigates alerts from SIEM, SOAR, and EDR tools and can send an outcome back. Cribl Detect can be the SIEM, and it pushes alerts to ITSM and SOAR rather than retiring them by default.
What public prices should buyers note?
Dropzone publishes a unit, not a dollar: up to 4,000 full investigations per year per AI analyst, unlimited users, integrations, named threat-intel feeds, chatbot, and an 8-hour support SLA. Enterprise single-tenant and MSSP multi-tenant are contact pricing. A Cribl Detect price with currency, unit, period, commitment, and included product was not found in this research.
Is Threat Hunter generally available?
Dropzone’s Agentic SOC post marks AI Threat Hunter as beta and marks AI Threat Intel Analyst as planned for Summer 2026. The AI SOC Analyst is the priced investigation product. The one-hour hunt claim on that post is a customer quote about Threat Hunter, not a list price.
