Crogl 2.4.1 Release Notes

We're excited to announce the release of Crogl 2.4.1, a fix release. Its two largest fixes matter most to a deployment running on its own: the local admin account now holds the administrator access it was always meant to have, and installs on Apple Silicon Macs run native containers instead of emulated ones. The chat timeline also gains the one thing it never showed you.

What's New

• Timestamps in Chat

Detailed Changes

Timestamps in Chat

The chat timeline showed who said what, and never when. Every message now carries the time it was sent, and the reply that closes a turn shows how long that turn took. You can read how long an investigation ran off the transcript itself, rather than asking the agent, which has no view of its own clock and tells you so.

The times sit inside the You and Crogl labels that were already on the page, so no row is added and nothing moves.

Bug Fixes

• On a deployment with no identity provider, the local admin account is now simply an administrator. It held every administrator permission but was confined to its own data, so it could not see the jobs Crogl owns and runs itself, could not see or configure the autonomous investigation job that ships with the product, could not open a system job's transcript, and was refused the team dashboard. Amendments it made to a report by asking the Assistant were also attributed to Crogl rather than to the person who made them. All of these now behave as documented.
• Apple Silicon Macs no longer run their agent containers under emulation. The macOS installer packaged an x86-64 agent image alongside its arm64 binaries, so starting a container and everything the agent did inside one was slower than it needed to be and used more memory. The installer now packages native arm64 images, and an installer refuses to run on a machine it was not built for rather than installing something that cannot match.
• An administrator's dashboard now opens on their own work. Two of the three analyst filters opened on all users, and the third fell back to doing the same, so an administrator's own queue was never what they saw first.
• The ticketing cards are left out when the signed-in account has no email address to scope them by. They previously fell back to a team-wide view, which showed one operator another person's tickets with nothing saying they were not theirs. Deployment Health and System Health need no address and stay, and System Health now spans the full row when it stands alone.
• An empty dashboard card now tells you why. Zeros can mean your address does not match what your ticketing system has for you, or that no Crogl account carries an email address yet, and both looked identical to a quiet week. Cards that cover a time period now say so rather than pointing at your address.
• The installer now explains what the local admin username is used for: if you plan to connect Jira or ServiceNow, it should be the email address you have in that system, because Crogl matches people to tickets by that address. It cannot be changed later without reinstalling.
• Installation no longer fails when HOME is unset.
• Guidance for reaching a Linux deployment over an SSH tunnel is correct, and stopping a deployment no longer fails.
• Test connection on a CrowdStrike connector now checks the credentials it was given. It had no endpoint to check them against, so the test could pass on credentials that would fail in use. Every connector Crogl ships is now required to declare one.
• The threat hunt skill named search and schema tools that Crogl does not expose. It now finds the connectors your deployment actually has and drives each one through its own connector skill.
• Work the agent runs inside its container no longer races. A command could return before it had finished, so anything sequenced behind it ran too early: a copy into a directory that did not exist yet, a file read before its ownership was set, or a cleanup that removed what had just been written, all while reporting success.
• The hint under the chat composer spells out the action it describes: it now reads "Type / for tools".
• A row's menu no longer closes on a scroll that cannot move it, and deleting an item lands on its list rather than leaving an empty tab.
• The release notes are now linked from the documentation header, alongside Guides and CLI Reference. Reaching them previously meant knowing the URL, which also left the release-notes archive and the known-issues page with nothing linking to them.