The first two weeks of Q4 produced a completed acquisition, a new SIEM from a pipeline vendor, a CEO change and the first AI evaluation product built into an established APM vendor's trace pipeline. Most of the news landed at three events: CriblCon 26 in Chicago, Honeycomb's September 29 release, and New Relic Now on October 6. The common thread is measuring the quality of AI output in production, with Dynatrace, New Relic and Honeycomb each adding a piece in the same fortnight.

Cribl Moves Into SIEM

At CriblCon 26 on September 29, Cribl announced Cribl Detect, a SIEM built on its existing telemetry platform. Detect runs detections in-stream and investigations across data where it already sits, and it is priced on infrastructure instead of ingest or search volume. Cribl puts the list price at roughly $18,000 to $20,000 per TB per month, scaling down with volume, and says Detect costs up to 50% less than other SIEMs. No independent comparison has been published yet. Detect is available now to Cribl.Cloud customers, with on-premises and self-managed options still under consideration.

Detect combines Cribl's streaming and federated search with technology from two acquisitions covered earlier in the quarter: CardinalOps for detection engineering in July and Radiant Security's AI SOC assets in August (Update #5). According to Futurum Group, the product adds detection posture management mapped to MITRE ATT&CK, AI SOC triage, SOAR and compliance features, and Cribl said at the event that it has passed $300 million in ARR with 1,500 customers.

Cribl also introduced StreamAI, an AI gateway that routes model requests, enforces budgets and spending cutoffs, falls back to cheaper models at cost limits, redacts sensitive data in prompts and responses, and logs every model call. Inference is free when StreamAI picks the model. Requests sent to a specific model are billed at the provider's token rates with no Cribl markup. The router draws on Cribl's own SecIT Bench, which tested 20 models across 30 IT and security investigations. A general availability date and the list of supported providers have not been announced.

Dynatrace Completes the Arize Acquisition

On October 1, Dynatrace completed its acquisition of Arize, the $915 million deal announced in August and covered in Update #5. Arize brings LLM tracing, evaluation and experimentation tooling: the managed Arize AX platform and the open-source Phoenix project, built on OpenTelemetry and OpenInference. Dynatrace states that Arize AX and the Dynatrace platform remain available as standalone offerings and that Phoenix stays open source. Dynatrace's stated rationale is to let teams evaluate AI applications before launch and monitor them in production on one lifecycle. A detailed integration timeline has not been published.

New Relic: New CEO, AI Evaluation and a CLI

On October 1, New Relic appointed Nandini Ramani as CEO and board member, effective immediately. Ramani most recently led a portfolio of observability, search and compliance services at AWS, and previously held engineering and product roles at X, Oracle and Sun Microsystems. Ashan Willy steps down and continues as an advisor to the board.

Five days later, at New Relic Now, the company announced AI Evaluation, a capability within New Relic AI Observability. An asynchronous LLM-as-a-judge service scans live telemetry and scores responses for hallucinations, prompt injections and data leaks, while guardrail checks on sampled inputs and outputs look for jailbreak attempts, PII leaks, toxicity and bias. RAG metrics such as faithfulness and answer relevancy are meant to separate model reasoning problems from retrieval problems, and quality is reported against token cost. The scores attach as attributes to distributed traces, so an engineer sees the prompt, the judge's reasoning and the backend behavior in one view. Pre-production tools include a prompt playground, versioned golden datasets and A/B experiments across prompts, models and configurations. Public preview starts in November.

New Relic also announced the Ground Truth CLI, which lets developers and AI agents query services, logs, alerts and changes, define recovery checks, and save investigation evidence from the terminal or a CI pipeline. Ground Truth and Autopilot are generally available, and the CLI entered limited preview on October 8. Ground Truth already exposes the same context to AI tools through MCP.

Honeycomb Zooms Out to the Agent Fleet

On September 29, Honeycomb released AI Ecosystem in early access, a fleet-level analysis layer covering agent performance, LLM cost tracking and agent conversations, the feature previously called Agent Timeline. It uses the same span telemetry as Agent Timeline, so no new instrumentation is required, and cost estimates come from model and token counts on spans priced at public list rates. Canvas Connectors, released as generally available in the same announcement, let Canvas agents read code and PR diffs from GitHub, incidents from PagerDuty, tickets from Jira, runbooks from Confluence and product analytics from Amplitude. Honeycomb lists 12 connectors, built on MCP, with reads allowed by default and each write requiring approval. Anomaly Detection also reached general availability.

Survey and Funding Signals

A Riverbed global survey published on October 6, conducted by Coleman Parkes Research in July among 1,200 respondents in seven countries, found that 90% of organizations want to use agentic AI to drive autonomous IT operations, while 77% are hesitant to let AI make operational decisions without human approval. 92% agree that AI observability and governance will become a critical new IT domain. On the current state, respondents report that 19% of IT operations are automated on average and only 17% have fully unified visibility across networks, applications, endpoints and cloud. Riverbed sells into this market, and the figures are vendor-published.

On October 9, OllyGarden raised $4 million from Next Frontier Capital, Grand Ventures and ACTAI Ventures, with existing investor DIG Ventures participating. Datadog, Grafana Labs and Dash0 made additional strategic investments. OllyGarden, founded by Juraci Paixão Kröhling, finds and fixes telemetry quality problems at the source before data reaches an observability backend, and says it has helped customers cut log volumes by up to 85%. Its AI OpenTelemetry engineer, Rose, recently added Minimum Viable Instrumentation. Three backend vendors that typically charge by data volume backing a tool that reduces that volume is the notable detail.

What to Watch

New Relic's AI Evaluation public preview is due in November. Snowflake's launch event for Observe's agent observability, noted in Update #8, is set for October 22. Cribl has yet to give dates for a self-managed Detect or for StreamAI general availability, and Dynatrace has yet to publish a timeline for bringing Arize capabilities into its platform.