What's New in Crogl 2.12.1

Crogl 2.12.1 brings six releases of work: deeper alert investigations, Claude 5 and GPT-6 models, Darktrace, and Kubernetes deployment. This post covers releases 2.8.0 through 2.12.0 and the 2.12.1 patch. Full notes for each release are in the release notes.

Highlights

• Deeper alert investigations and a new fast-triage skill
• Claude 5 and GPT-6 models, with a reasoning-level setting
• Darktrace, more Sentinel context, and a guided connector builder
• Scheduled jobs that run programs, enforce time limits, and pause together
• Chat and report exports to PDF and Markdown
• Broader crogl CLI coverage for pipelines
• Kubernetes deployment, including one-command install on Amazon EKS

Investigations

• Deeper alert investigations. The alert-investigation skill goes deeper on the ATT&CK tactics that warrant it, and the record reflects each step it took.
• Fast triage. Run /crogl-triage-alert for a quick benign, escalate, or inconclusive verdict on one alert, mapped to MITRE ATT&CK. Your ticket is not modified.
• See the work behind an answer. Review the parallel work Crogl runs next to the answer it informed.
• Interrupted turns keep their output. Failed, timed-out, and canceled turns keep the partial answer.
• Export a whole chat. Export a conversation as PDF or Markdown, including tool activity and delegated work.
• Clearer reports. Reports read more cleanly on screen and in PDF, link to the chat that produced them, and show their ID in the Investigations list.

Connectors and the knowledge graph

• Darktrace. Connect Darktrace with a Darktrace API token pair. The private token is encrypted and never exposed to the agent or reports.
• More Sentinel context. The Sentinel connector reads an incident's entities, comments, bookmarks, and related alerts.
• Guided connector building. /create-connector researches the target API with read-only calls, after you approve the endpoints and credential use.
• Connector package management. Administrators can validate, replace, and remove imported connector packages. Existing connections keep their settings.
• Splunk lookback setting. Limit knowledge-graph learning to the last 1, 3, 6, or 12 months (default 1). The first scan after upgrading drops sourcetypes with no events in that window, so set a longer one first if you need them.

Scheduled jobs

• Run a program. A job can run an executable instead of a prompt, with the exit code and output recorded.
• Time limits. Each run stops at its limit and is marked failed. The default is one hour.
• Pause all jobs. Administrators can pause and resume the scheduler for maintenance.
• Busy deployments. The Jobs, Runs, and Investigations lists page and sort on the server, with shareable URLs. Administrators can filter Jobs and Runs by owner.

Language models

• Claude 5 and GPT-6. Recommended models now include Claude Opus 5.5, Opus 5, Sonnet 5.5, and Sonnet 5, and the GPT-6 family. The upgrade keeps your current model.
• Reasoning level. Set how much a reasoning model thinks. Lower it to save cost or raise it for harder analysis.

Command line and API

• Broader CLI coverage. The crogl CLI covers most of the product, with paging, filtering, delete confirmations, and documented exit codes.
• Credentials out of shell history. Commands that take a credential can read it from a protected file or standard input.

Deployment and operations

• Kubernetes. Each release publishes a Helm chart and matching images. Amazon EKS installs with one command, and air-gapped sites install from a bundle.
• One port. The web UI, sign-in, documentation, and REST API share one port.
• Critical host alerts. Administrators are alerted when CPU, memory, or a filesystem turns critical.
• Software bill of materials. Every installer includes a CycloneDX SBOM and checksum manifest.
• Support capture and portal. Administrators can capture an unresponsive conversation for support, and tickets can be opened at https://support.crogl.com.

Fixes

• Signing back in after a session expires works without clearing browser data.
• Conversations and scheduled runs that stop progressing end with an error instead of hanging.
• Investigation report PDF export works in Crogl-served deployments.
• Installs on slower hosts complete and create the local administrator.
• Knowledge-graph learning completes on large Splunk and Jira deployments and keeps what it learned when a source is slow or unreachable.
• MCP connectors that fail tool discovery report the cause and let you add a missing credential. GCP service-account connectors can be created without the optional fields.

Under the hood

• Microsoft Entra machine-to-machine sign-in sends the correct scope by default.
• Dependencies are updated with current security patches in every release.

Before you upgrade from 2.7.2

Schedule a maintenance window and take a backup first. Three changes need your attention.

One port. The web UI, sign-in, and API now share port 4043, and port 8082 is removed. Update any load balancer, firewall rule, or bookmark that uses it. Server settings move from ui.* to web.*; the old names still work with a warning. The CLI offers to migrate its settings when run interactively.

Epoch-millisecond timestamps. REST API and CLI JSON timestamps are now integer milliseconds since 1970-01-01T00:00:00Z. Dates in the UI and reports are unchanged. The database is converted on first start of 2.12, and earlier versions cannot read it, so keep your backup until you have verified the upgrade. If you wrote your own connector scripts, see the 2.12.0 release notes.

Renamed CLI commands and API paths. Old names are removed with no aliases. Upgrade the CLI on every machine that connects to the server, and update scripts using the tables in the 2.11.0 and 2.12.0 release notes.