CROOK

Infralock Systems

CROOK

Browser-native endpoint console. Arm this session, enroll other browsers, correlate the hits. Not a kernel agent. Not a simulated estate.

By continuing you agree to the Terms and Privacy Policy. New estates start on a 14-day Estate trial. No card is taken here.

4.5.0 · 1,964 signatures

  1. 01

    Arm this session

    Continue with Google or X. Real-time intercept watches files, locators, and clipboard in this browser.

  2. 02

    Enroll other browsers

    Mint a fleet locator. Each device that opens it checks in as a real sensor — not a simulated host.

  3. 03

    Correlate the hits

    XDR merges the same hash, file, or locator across this session and the fleet. Invite analysts when you need extra seats.

What ships

Honest telemetry planes

Protect

This session

Files, locators, and clipboard in this browser are intercepted here. No kernel driver. No disk agent.

EDR

Enrolled sensors

Other browsers join with a fleet link. They send hardware hints, this-tab traffic, and objects you scan — not OS processes or NIC capture.

XDR

Correlate the estate

Cases merge when the same hash, file, or locator shows up on this session and a sensor. Cloud and mailbox planes stay down until you connect them.

Hunt

SOC desk

Query the session and fleet. Arm IOCs. Playbooks vault, contain, or fan-out to SIEM. ATT&CK coverage is only what CROOK actually saw.

Operations

Analysts, NTA, UEBA, SOAR

  • NTADestinations this tab loaded, OS sockets, Zeek logs, and Suricata EVE alerts from a TAP. No packet capture in the browser.
  • UEBASensor and session scores. No directory ingest.
  • SOARPlaybooks vault, contain, isolate this session, or fan-out to SIEM.
  • Hunt deskWatchlist, ATT&CK coverage, and an audit of what this console did.

Honest limits

What this is not

  • Not a kernel driver, disk agent, or native installer.
  • Not a simulated estate. Sensors are real browsers that check in.
  • Not a card form. Paid plans are invoiced to the billing email you set.

Billing

Monthly plans

Pay by card through Stripe, or issue an invoice to info@infralocksystems.cloud. Cards never touch this console. New estates start on a 14-day Estate trial.

Session

Free

This browser. One operator. Intercept, EDR, and XDR on the session you open.

Seats
1
Sensors
2
Packs
—
Webhooks
—
  • This-session intercept
  • This browser as a sensor
  • CEF / JSON export
  • No extra analysts
Start free

Analyst

$19 / seat / mo

Extra analysts and custom signature packs. SIEM export, no live webhooks.

Seats
8
Sensors
15
Packs
12
Webhooks
—
  • 8 seats
  • 15 fleet sensors
  • Custom signature packs
  • SIEM file export
Start trial

Estate

14-day trial

$49 / seat / mo

Fleet, seats, packs, and live SIEM webhooks. Invoiced monthly.

Seats
40
Sensors
200
Packs
12
Webhooks
8
  • 40 seats
  • 200 sensors
  • Live SIEM webhooks
  • Custom packs + CEF
Start trial