Crogl

Crogl, based in Albuquerque, New Mexico, builds an autonomous investigator for security operations teams at large organizations.

For each alert it gathers context, queries the customer's SIEM, EDR, identity provider and threat intelligence sources in their native formats, and cross-references the results, documenting every action while the analyst makes the final call.

It also checks incoming threat advisories against the customer's own stack, and analysts can ask questions about their alerts in natural language.

It runs inside the customer's infrastructure, on-premises, in a private cloud or fully air-gapped, with integrations listed for Splunk, Microsoft Sentinel, CrowdStrike, ServiceNow, Snowflake and others. The company says no data leaves the customer environment.