Crogl 2.8.0 Release Notes

Crogl 2.8.0 adds a Darktrace connector, more Sentinel incident context, scheduled job time limits, and clearer investigation reports. It includes every fix from 2.7.1 and 2.7.2, and we encourage all customers to upgrade.

What's New

• Connect Darktrace. Add a custom API connector with Darktrace authentication and a Darktrace API token pair. Create the pair on a Threat Visualizer account, grant it Unrestricted Devices, and keep the appliance clock within 30 minutes of real time. Use a read-only account to keep Crogl read-only.
• More Sentinel context. The Sentinel connector reads an incident's entities, comments, bookmarks, and related alerts.
• Job time limits. Each scheduled run stops at its limit and is marked failed. The default is one hour.
• Paging and sorting. The Jobs and Investigations lists page and sort on the server, and every view has a shareable URL.
• Find the source chat. A report links back to the chat that produced it.
• Clearer reports. Report sections read as text blocks on screen and in PDF, and every timeline event shows its date.
• Support capture. Administrators can capture an unresponsive conversation with crogl get-conversation-session-state and send it to support.

Fixes

• Investigation report PDF export works in Crogl-served deployments.
• Conversations and scheduled runs that stop progressing now end with an error you can act on.
• MCP connectors that fail tool discovery report the cause and let you supply a missing credential.
• GCP service-account connectors can be created without the optional advanced fields.
• Installs on RHEL-family hosts wait for the system package lock. This resolves the "GPG check FAILED" install error.

Under the hood

• Memory use stays steady on long-running deployments.
• Dependencies are updated with current security patches.