Crogl - AI for Enterprise Security (AMI)
Crogl is AI for the enterprise SOC. It investigates every alert and threat advisory using the tools and data already in your SOC, in their native formats, without schema normalization. Free for one user. Enterprise for your team under a paid annual agreement.
- Category
- AI Security
- Registry category
- Cybersecurity & ITThreat Detection & Response
- Vendor
- Crogl
- Location
- Not disclosed
- Reviews
- Not rated (0 reviews on the listing)
- Listed on
- AWS Marketplace
- Pricing
- 5 plans listed
Each fact carries one Provenance score: the average of its Disclosure and Evidence scores, the same rule the page uses for the overall score. Click any score to see the math behind it.
Vendor Provenance
Who actually operates this agent.
Build Provenance
What the agent is built on.
Reach Provenance
How the agent is distributed and adopted.
Data Provenance
What the vendor discloses about data handling.
Compliance Provenance
What standards the vendor meets, and who verified them.
What the publisher says
Crogl is AI for the enterprise SOC. It investigates every alert. It documents every action. Your analysts review the evidence and make the call.
Free and Enterprise
This AMI carries no software license charge. Free is for one user and remains free. It includes all connectors, unlimited skills, unlimited audit trails, username and password access, and direct access to Crogl engineers in the community Slack. You bring your own LLM provider credentials, and your model provider bills that usage.
Show the rest of the publisher’s description (14 more lines)
Enterprise is for SOC teams running Crogl around the clock. The paid annual plan adds unlimited users and investigations, autonomous investigation and threat hunting, single sign-on, role-based access control, and audit log export. It also covers use of your enterprise LLM service and dedicated support with agreed service levels. Pricing is custom and team based. No per-alert, per-investigation, or per-user fees.
Free and Enterprise run the same core platform. The plan determines the features and access available to your team.
What an investigation looks like
An alert lands. Crogl pulls the host and identity context, queries your EDR for process lineage, and checks the authentication record. It pivots to your data lake for anything the SIEM did not retain, then reads the relevant threat advisory. It writes down every query it ran and every result it got back. Your analyst opens the investigation, sees the reasoning, redirects it, and decides what happens next. Crogl handles the investigation. The analyst makes the call.
Crogl records the work in your ticketing or case management system. Auditable, repeatable, inspectable. Every investigation is an artifact you can hand to an auditor, a regulator, or your board.
Works where the data lives
Crogl queries your SIEM, EDR, identity, cloud, data lake, ticketing, and threat intelligence sources in their native formats, without schema normalization. There is no pipeline to build and no index to populate first. You can build connectors and skills for your own tools and workflows.
You bring your own model. Crogl runs against the LLM service you choose and host, including models that stay inside an air-gapped boundary.
Deployment
This AMI runs on Amazon EC2 in your AWS account. You control the deployment, its connections to your tools, and its connection to your model services. Most teams reach their first investigation within minutes of first login. Crogl also runs on premises, in private cloud, and in air-gapped environments. Contact Crogl for those options.
In production today
One defense organization runs Crogl against 60,000 alerts per month across 100TB of data, three SIEMs, and two SOARs, at an impact equivalent to six full-time analysts. Crogl is built for the hardest security environments.
Request Enterprise pricing
Enterprise is purchased through a private offer on the Crogl - AI for Enterprise Security solution in AWS Marketplace. That solution includes this AMI and Crogl Annual Production Support. Open that listing and select Request private offer, or contact Crogl at sales@crogl.com. Licensing and support terms are specified in your Enterprise agreement. AWS infrastructure and model services are billed separately.
Plans and pricing
5 plans listed
Linked repositories
Unknown
Unknown means this listing does not publish a repository. It is not a statement that the code is closed.
Sources
- Marketplace listingAWS Marketplace (opens in a new tab)
- Legal linkStandardEula (opens in a new tab)
Reading the score
Disclosure · how many sources corroborate it
Evidence · what kind of evidence backs it
The SettleTop steps above are possible but not automated yet, so today they sit open and a perfect 10 is out of reach. Open information like firmographics and reach has fewer steps to climb, so it sits a little higher for the same visible evidence.
Information shown here reflects the best available information at the time of assessment and may be incomplete, outdated, or subject to change. It should be independently verified before being relied upon for any decision. SettleTop is not liable for any errors, omissions, or decisions made in reliance on this information.
Have information about this agent?
Send it to us for consideration
Spot something missing, wrong, or out of date? Share what you know. Every note reaches our team. It does not change the passport by itself: we review it first.