Who does what
Provider
- AI investigation and threat-advisory analysis
- Evidence-gated dispatch to configured response playbooks
Your team
- Hosting, model services and tool permissions
- Playbook permissions, action verification and recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
Details
Service scope
Best for A SOC that needs automated investigation inside its own infrastructure and wants control over model choice.
Investigate
Queries tools and correlates alert evidence.
Dispatch
Checks evidence and triggers permitted SOAR playbooks.
Operate
Your team hosts it, verifies actions and handles recovery.
Full service analysis
Customer-hosted investigation with configured SOAR response
- Your team owns
- Operate the deployment and chosen model service.
- Set source permissions and validate investigation coverage.
- Maintain SOAR actions, approvals and incident recovery.
Pricing & contract
- Billing
- Custom
Enterprise uses a custom annual team contract with unlimited investigations. The free single-user install and its trial do not establish the price of continuous Enterprise operations. Confirm support scope, hosting and model-service costs and any separately purchased production support.
Tradeoffs & buying questions
Strengths
-
Self-hosted inference is available
Can run with self-hosted inference in an isolated environment.
-
Cross-source endpoint investigation
Correlates endpoint findings with identity, network and cloud evidence.
Considerations
-
Infrastructure and model operation remain with you
Your team must operate infrastructure, model access and source permissions.
-
Containment uses your configured response tools
Automated containment depends on separately configured customer response tools.
Ask before buying
- What infrastructure, model access and permissions are required?
- How are SOAR dispatch and action success verified?
- Which support entitlements does the annual contract include?
Integrations
Platform / SIEM
- Splunk
- Microsoft Sentinel
Endpoint
- CrowdStrike
- SentinelOne
- Microsoft Defender
Cloud
- AWS
- Microsoft Azure
- Google Cloud
Other integrations
- ServiceNow
- Jira
- Databricks
2 more integrations
- Snowflake
- Amazon S3
Common questions
Is the free version the same as an autonomous Enterprise SOC deployment?
The free tier is a single-user installation. The current plan comparison puts continuous autonomous operation, multi-user access, SSO, roles and dedicated support in Enterprise.
Can every deployment keep model processing local?
Crogl supports self-hosted inference and air-gapped deployments, but also lets you connect external model services. Choose and verify the actual data path for your deployment.