What's New in Crogl 2.16.0

Crogl 2.16.0 lets you identify a cloud asset without leaving the investigation, start investigations from your own pipelines, and see what each one costs. This post covers what you can do with the work in releases 2.13.0 through 2.16.0. The 2.16.0 release notes list every change.

Highlights

• Wiz connector. Identify a cloud asset from the IP address, instance ID, or resource name in an alert.
• AWS OpenSearch and Azure Government. Search OpenSearch domains, including GovCloud, and Azure Government workspaces.
• REST API reference. Open investigations from your own pipelines.
• PDF and JSONL export. Hand an investigation to a ticket, an incident record, or your data lake.
• Token usage per conversation. See what each investigation costs, by model.
• OpenRouter. One API key, models from several makers.

Identify a cloud asset in the same investigation

A cloud alert often arrives with an IP address or an instance ID and little else. Connect Wiz, then give Crogl the IP address, instance ID, or resource name from the alert. Crogl returns the account, region, and tags, with the asset's open issues and findings. The analyst learns who owns the asset and how exposed it is without opening a second console.

Two more data sources connect. The AWS OpenSearch connector searches an Amazon OpenSearch Service domain in commercial regions and GovCloud. The Sentinel and Log Analytics connectors reach Azure Government workspaces. A team that runs in GovCloud and Azure Government can investigate across both in one investigation.

Start investigations from your own pipelines

Crogl publishes a full API Reference for its REST API on the documentation site. Your code can create a conversation, send it turns, and read the answer. A ticketing or alert pipeline can open a Crogl investigation the moment an alert fires, so the evidence is gathered before an analyst picks up the ticket. The same API manages connectors, skills, and scheduled jobs. Run crogl get-openapi to download the specification.

A connector you build for an internal system now declares its own settings, and Crogl collects them on the connect form, the same way it does for a built-in connector. Connectors and model providers that require mutual TLS authenticate with a client certificate.

Hand the record to the next team

Export a chat as JSONL to load it into your data lake or to review investigations in bulk. Saved chats and investigation reports also export as PDF for a ticket or an incident record. Exports run from the UI, the REST API, or the crogl CLI, so a script can archive every closed investigation.

See what each investigation costs, and choose your models

Select the token icon on the full chat page to see the tokens a conversation used, broken out by model. Run the same investigation on two models and compare the tokens before you choose one for a scheduled job.

OpenRouter joins the model providers you can configure. One OpenRouter API key gives you models from several makers, including Claude. Nemotron 3 Ultra runs through OpenRouter or DeepInfra. Crogl still runs on the models you choose and supplies none of its own.

Control what the agent uses

Turn a skill off and Crogl stops using it until you turn it back on. Use this to pause a skill while you revise it, without deleting it or the work behind it.

Keep the docs for the version you run

Run crogl get-docs to download the documentation for your version as a PDF or as Markdown. An air-gapped site keeps the docs that match its install. The documentation also adds sign-on setup guides for Microsoft Entra ID, Keycloak, and Okta.

Under the hood. Knowledge-graph learning runs faster and uses fewer tokens. After you connect a new source, run crogl get-kg-summary to see what Crogl has learned from it, per connector, before you start hunting there.

Before you upgrade

The installer runs over your existing install and keeps your configuration and local data.

• Back up the database, attachments, and secrets together, at the same moment.
• Update the crogl CLI on every machine that connects, in the same window as the server.
• Update scripts that use a renamed command or a changed API path. The deprecations list each one.

Download Crogl to try 2.16.0, or read the 2.16.0 release notes for the full list.