Background detection in Cribl Guard is an AI-driven feature that continuously samples data in your Pipelines, scans it for new sensitive data patterns, and surfaces findings. You can then review findings, ignore them, or mitigate them by adding Guard rules.

Background detection workflow at-a-glance:

1. Enable background detection in AI Settings and on Destinations.
2. Commit & Deploy. Background detection runs in the background, sampling data streams for new patterns.
3. Review and act on findings from the Guard page (create rules, mark mitigated, or ignore).
4. Optionally refine scope per Pipeline or disable when needed.

Before You Start

​

• Cribl Guard must be enabled for at least one Destination. See Configure Cribl Guard.
• Environment: Background detection is available only in Cribl Stream when the Cloud Worker Group is hosted on AWS, in:
  • Hybrid environments with Cribl-managed Cloud Workers, or
  • Cribl.Cloud-only environments.

Enable Background Detection

​

Use this path to turn on background detection for your Workspace and choose which Destinations use it. Default sampling size and interval apply.

1. In your Cribl Workspace, select Cribl Stream.

2. Go to Settings > AI Settings.

3. Find Background Detection and toggle it On. This will enable the background detection tile on the Guard homepage.

   

   

4. In the sidebar, select Guard.

5. In the Background Detection column, select Enable Detection for each Destination you want to monitor.

   

   

   After you enable a Destination, the Background Detections tile shows total findings and a Review All link.

6. Select Commit & Deploy to push AI Settings, Guard config, and background detection scope to your Workers.

Background detection is now running. Next: Review and act on findings.

Review and Act on Findings

​

This is the main workflow after background detection is on: see what was found, then create rules, mark as mitigated, or ignore.

1. Open the Guard homepage, then either:

   • Select Review All in the Background Detections tile, or
   • Select the yellow detections count in the Background Detection column for a specific Pipeline.

2. Review the type of data found. Select a detection type (for example, CREDIT_CARD_NUMBER) to view sampled events.

   

   

3. Take action via the three dots in the Actions column (or from the events viewer):

   • Create Guard Rule: Cribl creates a rule; you add it to a Scanning Ruleset in your Cribl Guard Pipeline and Commit & Deploy so it mitigates data going forward. Successful rules mask those sensitive entities in data.
   • Mark as Mitigated: Labels the finding as mitigated for history; does not change rules or Pipelines. Use this after you create a Guard rule.
   • Ignore Datatype: Cribl ignores future detections for this PII type.

Optional: Refine the Scope of Background Detection

​

Use these options if you want to limit where background detection runs or turn it off for specific Pipelines.

Enable Per Pipeline

​

You can turn background detection on for specific Pipelines in a Worker Group so only certain data streams use it.

1. Open a Pipeline that contains the Cribl Guard Function.
2. Expand the Function and scroll to the bottom.
3. Toggle Background Detection on.

Turn Off in Specific Pipelines

​

To disable background detection for Pipelines with highly sensitive or constrained data:

1. Open the Worker Group, then Processing > Pipelines and the Pipeline that contains the Guard Function.
2. Toggle Background Detection off for that Pipeline.

Disable Background Detection

​

You can turn background detection off for a single Pipeline, for a Destination, or for the whole Workspace.

For One Pipeline

​

1. Open the Worker Group, then Processing > Pipelines and the Pipeline with the Guard Function.
2. Expand the Cribl Guard Function and toggle Background Detection off.

For One Destination

​

1. Open each Pipeline that sends data to that Destination.
2. Turn off Background Detection in every Cribl Guard Function in those Pipelines.

For the Whole Workspace

​

1. In the Workspace, select Cribl Stream.
2. Go to Settings > AI Settings.
3. Set Background Detection to Off.

Then Commit & Deploy so changes apply to your Workers.

When it’s off: If background detection is disabled in a Pipeline, PII in that Pipeline won’t get a Guard mitigation rule and won’t appear as a detection on the Guard page. If it’s off in global AI Settings, PII detected across Pipelines without a Guard rule won’t be shown as a detection on the Guard page.

Why Use Background Detection?

​

Common Use Cases

​