Crogl Reviews

My primary use case is that I run two websites on a single AWS EC2 instance. They're both based on WordPress. I'm using Crogl basically for security for that website. This includes the WordPress sites, plugins as an application layer security. I have EngineX and I get data from AWS Inspector. Then I have it all going into a single Splunk instance. Crogl is getting its data only from Splunk at the moment. I'm using it to protect that website because the website constantly gets attacked from bot traffic and from different adversaries all over the world.

I have security in depth, so in different layers. The first one is at a network layer inside of AWS itself. On the outside, I protected it that way. The second one is through different rules I have configured on my web server itself. Then I have to run WordPress. I also have different plugins that are installed that give me another application layer of security. In particular, it's called Wordfence. That's what I use as an addition. I use a combination of all of those things to protect it.

Geographical or sovereign rules don't really apply to me because I'm based in the US and I don't have anything regarding any necessarily rules or regulations that I have to follow regarding a different region. I do have Cloudflare in place. I get data from that as well.

I noticed a lot of traffic with a lot of bots attacking the site at once. My concern was making sure that no plugins or files were installed on the server because from what I can tell on Splunk, that's what they were looking to do—basically infect my server with malware or malicious plugins inside of WordPress. Within minutes I had it installed and within seven minutes, I had an answer that says I was secure.

The skill itself is what I go back to now. Only on occasion will I go and look at my actual Splunk instance. The skill will constantly look at the data that Splunk has and just reassure me that I have everything I need and that it's secured.

Crogl tells me if my layers are properly configured. First of all, it confirms whether I have security in depth with the different layers. The second thing I appreciate is that I now have a skill built within the platform that gives me ongoing assurance that my sites remain protected. I did a one-time assessment with it using all the data I have in Splunk, but now that I have a skill configured, I can go back to that and it lets me know that I'm still protected. For example, that recent PHP vulnerability that came out a week or two ago was a perfect test for my skill. I upgraded my PHP on my Linux server, but then I reran the skill to make sure that everything was still secure and I had an answer right away. To have that available is invaluable.

I was able to get a report. I did mine in markdown so I had it to document it. I just used Crogl's interface to generate it for me. I didn't do anything special.

The only downside that I've seen so far regarding Crogl were two things. The install process has already been corrected from their earlier versions. You do have to be a developer that understands Docker and how to get that set up. It's not a downside for me personally, but that's one thing. The other thing was when you set up a connector, you can only set up a single connector to one Splunk instance. For me personally, I don't feel it's an issue, but for others that are using multiple Splunk instances, they may need multiple connectors to different instances, not just a single Splunk instance.

I started the review process roughly five months ago last summer.

I haven't experienced any stability issues when I used Crogl. Keep in mind my usage is pretty low. I don't tax it because I have a small Splunk instance and for a single site. My source is Splunk even though it's aggregating all my data.

Because it's a microservice, I would expect it to be scalable. I'm only running a single instance in Docker, but I'm sure it's supported on Kubernetes.

I used the community site that they have on Slack. It was fine. Anytime I needed support, I got an answer fairly quick, especially it being a community site and it was from somebody at the company. I'd rate Crogl a nine.

I've seen Crogl work in different ways, but for me to have it installed locally and not the data in the cloud, that's different for me.

Crogl tried to do too much, assuming that non-developers might attempt to use it when I think you're going to have some basic background. Anybody that uses it is going to have a background in Docker and how to configure it and run basic containers and services. I think they now just state their prerequisites ahead of time and then you just run the product within Docker. They tried to do too much before and I don't think it was overkill. They just state the prerequisites with it now and everything goes smooth.

It wasn't difficult at all. The documentation is embedded, but only after you do the install. Once you have it installed, then the documentation is available. I've actually submitted a request to make that documentation more public after the fact. It was self-explanatory because the documents run you through it. When I was building my skill, for example, I used the documentation to do that.

I'm using the free version of Crogl right now.

I applied for other non-profit licenses to be used with other vendors' products. I wasn't able to get that license. Others I have, Splunk gave me a non-profit license to use.