Crogl 2.6.0 Release Notes
Crogl 2.6.0 establishes whether the hosts in an investigation were vulnerable when the event happened, sets up an MCP connector from a request in chat, and warns an administrator when the deployment host is running short on CPU, memory, or disk.
What's New
- Vulnerability Context in Investigations
- Create an MCP Connector from Chat
- Know When the Host Runs Short on CPU, Memory, or Disk
- Choose Which Ticketing Connector the Dashboard Shows
- Token Limits Default to the Model's Maximum
- Send Files Without a Message
- See How Much Each Report Section Holds
Detailed Changes
Vulnerability Context in Investigations
An investigation now establishes whether the hosts it touched were vulnerable when the event happened, and reports what it found. The report carries a Vulnerabilities section listing the findings that bear on the alert, each paired with the host it affects, and it records why a finding that looked relevant was set aside. What it finds feeds the severity Crogl assigns, so a known-exploited finding on an affected host weighs more than the same alert on a host that was already patched.
You can run the lookup on its own as well. The crogl-investigate-host skill reports what a single host was carrying, which is the same evidence an alert investigation works from.
Create an MCP Connector from Chat
Ask for an MCP server in chat and Crogl proposes the connector, then collects the credential and the tools to turn on in a single step. An MCP connector previously had to be added through Settings. Crogl checks the proposal before you type anything, so a connector name that collides with one you already have, or an endpoint that is not HTTPS, fails before it reaches you. You choose which of the server's tools to enable, and at least one is required.
Know When the Host Runs Short on CPU, Memory, or Disk
Crogl now warns an administrator when the deployment host is running short on CPU, memory, or disk, and keeps warning until the resource recovers. The notice follows you wherever you are in Crogl instead of waiting on the dashboard for someone to open it, which is how a disk could fill up unnoticed over days.
Choose Which Ticketing Connector the Dashboard Shows
With both Jira and ServiceNow connected, the dashboard names which one its numbers come from and lets you switch between them. The picker appears only where the choice exists, meaning two or more ticketing connectors are configured. Your choice is carried in the page's address, so a reload or a link you share opens on the same connector.
Token Limits Default to the Model's Maximum
Leave the context window and output limits blank for either model and Crogl uses what the model itself publishes, so configuring a supported model needs no numbers you have to look up. Set a limit yourself only where your provider serves less than the model's maximum.
Send Files Without a Message
You can send attachments on their own, with no text of your own alongside them. Pasting a large block of text attaches it as a file too, so a log you paste follows the same path as a log you attach.
See How Much Each Report Section Holds
Every list section of an investigation report now says how many items it holds, so you can tell which sections are worth opening without opening them. Counts had reached only two of the report's sections before.
Bug Fixes
- The catch-all Other language-model provider is now Other (OpenAI-compatible) and saves an OpenAI-protocol configuration. Configuring an OpenAI-compatible endpoint through it previously saved the wrong protocol, and the connection test then failed for a reason that pointed nowhere. Reach a custom Anthropic-compatible endpoint through the Anthropic provider, whose model URL is editable.
- A list keeps the rows it is showing when a refresh fails, instead of emptying.