Crogl - AI for Enterprise Security (AMI)

Crogl is AI for the enterprise SOC. It investigates every alert. It documents every action. Your analysts review the evidence and make the call.

Free and Enterprise

This AMI carries no software license charge. Free is for one user and remains free. It includes all connectors, unlimited skills, unlimited audit trails, username and password access, and direct access to Crogl engineers in the community Slack. You bring your own LLM provider credentials, and your model provider bills that usage. Enterprise is for SOC teams running Crogl around the clock. The paid annual plan adds unlimited users and investigations, autonomous investigation and threat hunting, single sign-on, role-based access control, and audit log export. It also covers use of your enterprise LLM service and dedicated support with agreed service levels. Pricing is custom and team based. No per-alert, per-investigation, or per-user fees. Free and Enterprise run the same core platform. The plan determines the features and access available to your team.

What an investigation looks like

An alert lands. Crogl pulls the host and identity context, queries your EDR for process lineage, and checks the authentication record. It pivots to your data lake for anything the SIEM did not retain, then reads the relevant threat advisory. It writes down every query it ran and every result it got back. Your analyst opens the investigation, sees the reasoning, redirects it, and decides what happens next. Crogl handles the investigation. The analyst makes the call. Crogl records the work in your ticketing or case management system. Auditable, repeatable, inspectable. Every investigation is an artifact you can hand to an auditor, a regulator, or your board.

Works where the data lives

Crogl queries your SIEM, EDR, identity, cloud, data lake, ticketing, and threat intelligence sources in their native formats, without schema normalization. There is no pipeline to build and no index to populate first. You can build connectors and skills for your own tools and workflows. You bring your own model. Crogl runs against the LLM service you choose and host, including models that stay inside an air-gapped boundary.

Deployment

This AMI runs on Amazon EC2 in your AWS account. You control the deployment, its connections to your tools, and its connection to your model services. Most teams reach their first investigation within minutes of first login. Crogl also runs on premises, in private cloud, and in air-gapped environments. Contact Crogl for those options.

In production today

One defense organization runs Crogl against 60,000 alerts per month across 100TB of data, three SIEMs, and two SOARs, at an impact equivalent to six full-time analysts. Crogl is built for the hardest security environments.

Request Enterprise pricing

Enterprise is purchased through a private offer on the Crogl - AI for Enterprise Security solution in AWS Marketplace. That solution includes this AMI and Crogl Annual Production Support. Open that listing and select Request private offer, or contact Crogl at sales@crogl.com . Licensing and support terms are specified in your Enterprise agreement. AWS infrastructure and model services are billed separately.