Sponsored by: Crogl | Building AI for Enterprise Security. A neuro-symbolic approach

Summary

Crogl addresses the high failure rate of enterprise AI security projects by combining neural and symbolic AI in a neuro-symbolic architecture designed for regulated SOC environments where off-the-shelf LLMs consistently fall short.
The Crogl platform comprises four components—skills, an agent, a knowledge graph, and a harness—where the harness enforces operational controls and maintains an audit trail aligned with enterprise compliance requirements.
This video draws on experience with US DOD and Fortune 500 organizations to demonstrate why model-agnostic, purpose-built security AI outperforms single-technology LLM approaches in production environments.

Chapters

FAQs

What is neuro-symbolic AI and why does it matter for enterprise security?

Neuro-symbolic AI combines neural networks—which interpret context and reason over language—with symbolic systems that enforce rules, logic, and structured knowledge. For security operations, this mirrors how human analysts already work: using pattern recognition alongside documented procedures and rule-based triage workflows.

Why do off-the-shelf LLMs fail in regulated SOC environments?

LLMs lack environment-specific context, operational consistency, and the ability to enforce governance controls required in regulated security environments. They have no awareness of an organization's unique policies, tooling, or incident response procedures, leading to unreliable and ungovernable outputs.

What are the main components of the Crogl architecture?

The Crogl platform is built around four components: skills (task-specific capabilities), an agent (the reasoning engine), a knowledge graph (structured enterprise context), and a harness that enforces operational controls and maintains a full audit trail. Together these enable reliable, auditable security operations automation.

What security use cases does the Crogl approach support?

Based on experience with customers in the public sector and financial services, Crogl's architecture supports threat detection, alert triage, investigation workflows, threat hunting, IOC extraction from advisories, and compliance use cases such as interpreting policy controls and assessing their current state.

Full transcript

[00:10] So, welcome to this talk on building AI for enterprise security. Um a neuro-symbolic approach. Uh my name is Lip-yeow Lim. I'm a distinguished engineer and the head of AI at Krogol. Uh you might have seen that in the program
[00:22] Manzi Mirza, our co-founder, is supposed to be here, but unfortunately he has a scheduling conflict, and so I'm here kind of speaking on his behalf. Um I'd like to welcome you, warm welcome to to
[00:34] this talk. And maybe just a quick show of hands, and this is a small crowd, which means we can be a lot more interactive, and we can actually I can actually tailor this talk for you guys. So, just a quick show of hands, any of
[00:46] you like C-suite folks, C-level folks? Security engineers? All right. Data engineers? Awesome. Okay, so that covers the room.
[00:58] Um so, okay, let me let me just uh give an outline of this talk. Um spend some time on intros, and then I'll dive into security ops problems, and then finally talk a little bit about
[01:11] neuro-symbolic design, uh which is kind of the focus of what we do at Krogol. So again, I'm Lip-yeow Lim, head of AI at Krogol. Um I spent quite a bit of time at uh Splunk previously, and then
[01:24] Databricks as well. Um and then at Mandiant. Uh I think that's where I had a lot of exposure to uh security and to supporting the Mandiant SOC and the Mandiant incident responders. Um building tools for them
[01:38] as well. I also spent some time at IBM Research and the building data systems, like DB2 database systems, uh and the Infosphere stream systems.
[01:51] So, um what I would like to really bring to you today is um that based on everything that we have uh our experience of talking to different customers, we have actually found that security
[02:03] teams really want to use AI for threat management and compliance. Right, we have seen this at many many customers ranging from the public sector to like big uh big banks and financial services.
[02:17] Right, and they have seen that AI can really help them with detections, right, with investigations, especially querying data, interpreting results, automating workflows. Um AI is fantastic for threat
[02:30] hunting, uh for like extracting IOCs from advisories, and then organizing hunting campaigns, crafting queries for hunting, and sort of enriching the local
[02:42] data that they have. Right. We'll have We'll also have seen compliance use cases with like, you know, interpreting uh requirements from various uh policies, controls, and gathering data
[02:55] to and analyzing the data to see uh what is the state of those controls. I mean, then of course kind of on the reporting side, kind of generating reports from different data sources, documenting the work, and surfacing it as as as
[03:08] dashboards. So, we've definitely seen a lot of interest from security teams. However, right, what we have also seen is that there are complications with using AI, like off-the-shelf AI
[03:22] solutions uh for security. Right? Um and there's a lot of operational aspects to this, right? In the sense that if you just, you know, use uh say off-the-shelf say cloud desktop, for example, or cloud co-work,
[03:36] right? It doesn't fully understand your environment. It doesn't understand how your company operates, right? So, the LLMs don't know your data, it doesn't have any historical context over your data, there's no awareness of the kinds
[03:49] of process and procedures, right, that a typical SOC um has to abide to. This is especially true for like regulated industries, like for public sector, for financial services, where everything
[04:02] needs to be auditable, everything needs to be regulated. And then there's unclear governance model in terms of like authentication and of authorization. There's also data sovereignty challenges. You don't want the data to
[04:15] leave the premises for a lot of these regulated industries. And then audit explainability as well of the results. Right? And we know data is everywhere and trying to figure out the right data
[04:28] to query, the schemas and the semantics of that data, that's also extremely challenging for LLMs to just handle. And then last but not least, right, the lack of operational consistency. I think
[04:40] this is a big one, right? Most of these regulated industries, they have very strict audit requirements. They have very strict requirements in terms of how security investigations must be done and
[04:54] what are the controls that needs to happen when you do those security investigations or even threat hunting.
[05:08] And if you think about it, right, SOC investigations, right, are neuro-symbolic work. So, what does neuro-symbolic mean? Right? Now, this term actually is an evolution from for those of you who have been around for a while and looking at
[05:22] AI, if you remember like 40, maybe even 50 years ago, there was this whole debate between connectionist systems and symbolic systems. It was a huge divide in AI where there's
[05:35] a camp, there's a school of thought that says, "Hey, AI should be all neural networks." And there's a school that says that all AI should be symbolic reasoning, right, including things systems like Prolog, Datalog, and so on, right? But I
[05:48] think now we're at a point where we're trying to get the best of both worlds, and so the neuro-symbolic systems came out of that in that we want the best of neuro systems, and we want the best of
[06:00] symbolic reasoning systems, and we want to combine them in a very seamless way. And so that's how the term came about, right? And like I said, if you think about it, when a human SOC analyst
[06:13] analyzes a investigates an alert, right? Or investigates an issue, his workflow has aspects of both. Right? If you think about it, he gets an
[06:25] alert, he has to use his judgment to figure out, "Hey, what what data sources should I query um first? And how do I reason about the results?" So you write some queries, then he executes those queries, and you
[06:38] know, those query executions are completely deterministic. They're handled by querying systems like Databricks, for example, or Splunk, right? And then the results come back, he has to interpret the results, uses best judgment to figure out what it
[06:51] means, and then figure out where to go next from there. Maybe pivot to a different system, pivot to querying CrowdStrike, pivot to querying threat intel like VirusTotal, and then interpret the result and keep going,
[07:04] right? So there aspects of that workflow that are purely symbolic reason that symbolic processing, deterministic code even. And there aspects of that workflow that
[07:17] are kind of fuzzy, squishy, like interpretation, judgment, right? And that kind of falls more in the in the neural camp of the world.
[07:29] Right? So in a sense, SOC workflows are neuro-symbolic workloads, right? And so the question is then, how do we build AI systems that support
[07:42] these workflows. And this is the big question. Point this here. Wait, sorry.
[07:59] So, the way that uh Chronicle sees neuro-symbolic systems, at least today, is we think of it as three layers or three components. We have the neuro layer, right? And when you think of neuro,
[08:11] I mean, today we all just think of LLMs, right? So, we have LLMs, frontier models, and so on. And then we have the harness that actually tries to tie the LLM with the symbolic layer, right? The symbolic
[08:24] layer would encode things like rules, um things like knowledge graphs, and so on. And so, these three pieces work together to
[08:36] help the analyst investigate alerts, do their security workflows over all these security tools, your business tools, and your data lakes. So, these are your SIMs, your EDRs, your IAM
[08:52] tools, your cloud, your threat intel tools, and your ticketing tools, and so on. So, this is how we think about a neuro-symbolic system.
[09:05] And so, let me dive a little bit deeper into each of these layers, right? So, the neuro layer, right? These are your frontier models, your open-weight models, your customer-specific models. Um you'd be surprised that many many big companies
[09:18] actually have their own models. Um and these are these would be third-party services, right? And on the symbolic side, we have things like skills, investigation patterns or rules, uh
[09:31] controls, right? Rules for handling evidence, interpreting evidence. And then your knowledge graph, right? You have that maps So, it provides a map of your schema, of the semantics of the data that you have in say data bricks,
[09:45] right? Um and then again, the harness that ties everything together, there's like three components within the harness. You have your agent, right? That actually leverages the neural layer to drive the
[09:57] investigation, that orchestrates, right? Chooses the next steps, right? Makes tool calls, right? Then you have the governance layer that provides all the protection, right? Your product security, auditability,
[10:10] um your user isolation, your component separation, and so on. And then you have the operations aspect that that gives you the observability, the repeatability, the consistency, and the reliability
[10:22] um of the whole system, right? So, let me dive into just some of this. Um LLM The LLMs is mainly used for reasoning,
[10:35] right? And today, right? I think multimodal support is table stake, right? Um all companies have access to multiple frontier models, they have access to open weight models, and the
[10:49] ability to switch between those seamlessly is something that we see our customers ask all the time, right? Um moreover, right? If you if you just rely on say a single provider, we have seen
[11:01] like I think even last July, um there was an outage at Anthropic, and all of us were so spinning our wheels, like, what's going on? So, we we can't use Claude code anymore uh for a little bit. So, we have
[11:15] seen some of those outages. So, the ability then to actually switch between models, right? Is critical to resiliency, right? Um And so, again, the LLMs will help with
[11:28] the fuzzy, squishy part of the workflow, things like interpreting context, things like reasoning about the investigations, uh things like figuring out what to do next.
[11:44] And then we have the knowledge graph. This is the symbolic piece, if you will, right? The symbolic the knowledge graph helps with retrieval, helps with uh helps drives consistency, helps helps the the agent
[11:56] to figure out what's in your SIM, uh what's what's in your identity systems, what's in your endpoint systems, what's in your ticketing systems. It figures out which facts are authoritative, uh
[12:08] what are the relationships and correlations between all your data, and it figures out what is the evidence path, right? The evidence to support the attack, if you will.
[12:24] And then the harness, this provides the operational control. It's the thing again, the thing that glues together LLM, your skills, your agent, and the graph, right? And this is So this is the neuro-symbolic core, if you will. And uh want to sort of talk a bit about
[12:37] skills, right? The skills is now a critical part of your AI system. It is the part that actually encodes the playbook or the investigation steps or the rules, right? That govern your
[12:51] investigations, that govern the analyst workflow in the SOC, right? And so it is a critical piece for like the ability and from operations point of view as well.
[13:04] Oops. This thing always goes a little bit too fast. Um agent, I think we talked about this before. This helps to drive the investigation, it keeps things on track. Uh it's the orchestration there.
[13:17] It helps with tool use, um and so on. I think most of us know know this already, so I'm not going to uh belabor that. Um so So, skills again, I mentioned this earlier. This is the thing that turns your
[13:30] AI systems into a repeatable um system that you know, that is operationally ready for most enterprise SOC. Right? It gives you repeatability,
[13:43] gives you process alignment, gives you the required controls and checks, and so on. Okay. With all of those pieces, let's come back to the system roof.
[13:55] Right? So, what the whole system does is that you have skills that define work, the agent that drives work, the graph that sort of ground your agent so that it doesn't go off the rails
[14:07] because the graph helps to ground your agent to into like what is really what the semantics, what's really in the data. Right? You have your LLMs that helps do the generation and the reasoning over facts. You have the harness that
[14:20] enforces controls, and then you have the evidence, right? That helps support review and auditability and explainability, right? Um so, this is what we try to build at Krogol,
[14:34] what we have built in our Krogol product. Uh it's a reliable SOC AI system. It's not a single model call, right? It's a loop that combines procedure execution, fact retrieval, reasoning, and control.
[14:55] So, neuro systems gives interpretation, right? Symbolic systems give structure, and security operations need both. Right? And Krogol is the AI for enterprise SOC, and this is what we have built. And um
[15:09] would love to invite you. I don't have a demo right here, but our booth is just right there. It's the second booth facing the uh the wall there. So, go see a demo there of Coralogix.
[15:22] Um, and also Coralogix free to download. It's for you to try and use. So, please join our Slack group with a Slack community group. Anybody can join. Um,
[15:35] anybody can download. You can download this. Uh, you just need to provide an an LLM point. Ideally a frontier model, and you can play with it to your heart's content.
[15:47] All right. And so, here I'll kind of pause for questions. Any questions from the audience? All right. Thank you very much, everyone. Thanks for coming.

Learn more about the Databricks Data and AI platform.

The information provided herein is for general informational purposes only and may not reflect the most current product capabilities or configurations.