Cerbi enforces logging policy inside your .NET application — before any log event reaches a pipeline, storage platform, or observability vendor.
CerbiStream is a NuGet-based .NET runtime SDK that governs log events before they reach any downstream sink. CerbiShield is the tenant-hosted control plane for rules, visibility, and audit.
- One-line setup
- No pipeline migration
- Works with Serilog, MEL, and NLog
The Cerbi model
CerbiStream
Runtime SDK
- NuGet package — no agents, no infra
- Runs inside your application process
- Validates and governs logs before emission
- Works with Serilog, MEL, and NLog
- Zero network calls on the hot path
CerbiShield
Governance Control Plane
- Tenant-hosted dashboard — your infrastructure
- Rule management, violations, and audit trail
- Governance scoring and reporting
- Async — never on the hot path
- Available on Azure Marketplace
Enforcement inline.Scoring and oversight out of band.
Ifyou'rerelyingoningestmasking,you'realreadytoolate.
Cerbi — governance at the source
The pipeline is backwards
You can't fix bad logs after they've been ingested.
Today
With Cerbi
Interactive Demo
See Cerbi in the Log Path
Pick a scenario, configure governance rules, and watch what gets sanitized, blocked, and routed asynchronously — before a single byte reaches your observability platform.
{
"timestamp": "2025-04-12T14:32:11.042Z",
"level": "Information",
"message": "Payment processed",
"correlationId": "ord-8821-xk",
"userId": "u_4492",
"ssn": "382-91-0047",
"cardNumber": "4111-1111-1111-1111",
"cvv": "392",
"amount": 149.99,
"service": "payment-api",
}hot path
// Run example to see output
// Governance score, violations, and async routing appear here
This demo runs entirely in-browser. No log data is transmitted. Behavior reflects Cerbi's in-process governance engine for .NET.
Risk & compliance
Sensitive data in logs creates exposure
PHI, PII, credentials, and tokens written to log sinks become a liability the moment they are ingested — regardless of who controls the destination.
Detection after ingestion is too late
Scrubbing sensitive data from Splunk or Datadog after the fact is operationally expensive and may not satisfy auditors. The log is already stored, indexed, and potentially replicated.
Cerbi prevents bad behavior before storage
Governance runs at emission time — before any network call, before any sink, before any pipeline. If a rule is violated, it is blocked or sanitized in-process.
Cerbi does not provide legal or compliance advice. Consult your compliance team for regulatory obligations specific to your industry.
Adoption
Adopt in minutes.
CerbiStream drops into your existing .NET logging setup. No migration. No new infrastructure on the hot path.
Full setup guideFree trial
14 days · 5M governed events
No credit card required. Full platform access.
View trial detailsInstall-Package CerbiStream.UseCerbi(cfg => cfg.LoadProfile("governance.json"))governance.json → committed, versioned, reviewedNo agents · No pipeline rewrite · No sink replacementWhy teams adopt Cerbi
Prevent data leakage
Stop sensitive data at the source instead of masking later. PHI, PII, tokens, and credentials are blocked before they ever reach a downstream platform.
Improve audit readiness
Logs are compliant by default, not retroactively fixed. Every log event is governed at creation time, giving you a clean, defensible audit trail.
Reduce observability cost
Filter noise before ingestion. Blocking irrelevant events and redundant fields before they leave the application reduces Splunk and Datadog ingestion spend.
Standardize logging behavior
One policy across all services and teams. Required fields are enforced, schema violations are flagged, and logging behavior is consistent across every service.
Who this is for
Built for the teams who own what gets logged.
Cerbi is a fit when logging behavior needs to be a controlled, auditable property of the platform — not a per-team decision made at the call site.
Platform engineering
You own the internal developer platform or shared logging infrastructure. You need consistent policy enforcement across many services without mandating call-site rewrites or deploying new pipeline components.
Security and compliance
You are responsible for preventing PHI, PII, credentials, and sensitive fields from reaching observability platforms. You need evidence that governance is applied at emission, not retroactively cleaned downstream.
Architecture leadership
You are designing or auditing logging strategy across a distributed .NET estate. You want governance that is version-controlled, policy-driven, and compatible with Serilog, MEL, and NLog without lock-in.
Scope
What Cerbi is not.
Clarity on scope is part of a credible product. Cerbi does one thing well: governs logging behavior at the source.
Not a SIEM
Cerbi does not collect, correlate, or alert on security events. It governs what is written to logs at the source. Your SIEM receives cleaner, more consistent data as a result.
Not a log storage platform
Cerbi has no log storage. Your existing destinations — Splunk, Datadog, Azure Monitor, Elastic, Seq — remain unchanged. Cerbi sits before them, not instead of them.
Not a replacement for your observability stack
Cerbi does not replace Datadog, New Relic, Grafana, or any observability vendor. It makes the data those platforms receive more accurate, consistent, and policy-compliant.
Not a log router or transport layer
Cerbi does not proxy or relay log traffic. There are no additional network hops on the hot path. CerbiStream is in-process; CerbiShield is async and out of band.
What it is
- A .NET runtime SDK that governs log events before emission
- A governance control plane for policy management and audit
- A source-side filter that reduces ingestion noise and cost
- A compliance tool that enforces schema at the point of creation
Next
Understand why bad logging behavior is systemic, and what it costs.
The problems aren't random. Every team runs into the same patterns. See the full picture.