Graylog

Logs carry IP addresses, user IDs, and session tokens. That makes them regulated data. When observability tools send logs to a vendor’s default region, they can cross borders unnoticed. Here’s how data residency laws apply to log data. graylog.org/post/what-ar...

PHP2Shell turns a stock php.ini into an unauthenticated RCE. Most attempts crash the PHP worker before they succeed, and that crash leaves a trail. Four Graylog searches that follow it, from the multipart POST to a shell spawned by php-fpm. graylog.org/post/detecti...

A Sankey chart scales each link by the volume it carries, so an unusual flow between hosts stands out instead of hiding in a log table. Here’s how security teams use them for network traffic, authentication paths, attack paths, and log routing. graylog.org/post/how-sec...

Want to find out more about Graylog 7.2 release? Sign up for the webinar here: graylog.org/open-webinar/

One-click add from search results. Graylog Security Watchlists turn the values your team cares about into live context across searches, dashboards, and alerts. Flag it once. See it everywhere. Setup alerts for those VAPs (Very Attacked People). graylog.org/post/watchli...

What’s new in Graylog 7.2? - Less time triaging alerts. - Less time managing the platform. - Direct control over the data flowing in. Case-based triage, smarter admin tools, and the native Graylog Collector make it happen. graylog.org/post/graylog...

Most Windows environments are logging, but not watching the right things. Logons, privilege use, account changes, scheduled tasks, policy tampering, AD trust changes. Miss a category, miss the breach. What's your SIEM actually alerting on? graylog.org/post/critica... #CyberSecurity #BlueTeam #SIEM

India's Digital Personal Data Protection Act (DPDPA) is here. It applies to any org handling Indian residents' data. Is your security stack ready? graylog.org/post/indias-... #DPDPA #DataPrivacy #Cybersecurity

Vulnerability exploitation is now the most common initial access vector for breaches. A vulnerability assessment tells you where you stand today. A vulnerability management program keeps you there. graylog.org/post/the-val... #VulnerabilityManagement #InfoSec #CyberSecurity #SIEM #BlueTeam

Attackers only need one unlocked door. In the 2026 DBIR, vulnerability exploitation overtook stolen credentials as the top way in, at 31% of breaches. Only 26% of known exploited vulnerabilities were fully fixed. Our new blog covers how to close that gap. graylog.org/post/the-val...

JSON is the standard format for structured logging. Parsing it turns raw text into objects you can filter, correlate, and act on. Our new blog covers parsing in JavaScript, Python, PHP, and Java, plus best practices for JSON logs. graylog.org/post/what-to...

WatchGuard Firebox Firewall Data in Graylog. The Illuminate content pack parses Fireware syslog, maps events to GIM, and surfaces IPS, GAV, and APT detections as network detections. Setup takes three steps. graylog.org/post/watchgu... #Graylog #WatchGuard #SIEM

SIEM and observability costs scale with data volume. Pipeline management is how you keep collecting the telemetry you need while routing low-value logs to cheaper storage. graylog.org/post/data-pi...

Miss the Graylog Inputs Demystified webinar? Watch it here: graylog.org/post/inputs-...

New on the blog: 25 Linux logs worth collecting and monitoring, from auth.log to audit.log, with a rundown of terminal commands (grep, awk, journalctl) for reading them. graylog.org/post/25-linu...

If you're running Suricata, you already have the data. The question is whether it's usable. Graylog's Suricata IDS/IPS Content Pack parses EVE JSON, normalizes it to GIM, and gives you a ready to use dashboard for alerts and more. graylog.org/post/suricat... #Graylog #Suricata #SIEM #NetworkSecurity

Application performance management in cloud-native environments is harder than it looks. Containers disappear before you can investigate them. Alerts pile up until nobody trusts them anymore. New guide: 5 best practices for engineering leaders. graylog.org/post/what-is...

Getting logs into Graylog doesn't require a PhD in syslog or other log sources. Sept 23, 10AM EDT: The Input Wizard, and the inputs pages 20 min content + 10 min Q&A. Make sure you're on the latest version. Register here: graylog.org/post/inputs-...

Linux syslog varies wildly by distro: rsyslog, syslog-ng, journald, different file paths, different defaults. Our new guide covers how to locate, configure, and centralize this data so troubleshooting doesn't mean guessing where the logs live. graylog.org/post/a-pract...

Protecting the electric grid means complying with NERC CIP, 13 standards covering physical security, patch management, incident response, and more. Our blog explains what each standard requires and how a SIEM supports compliance without the overhead. graylog.org/post/ferc-an...

Kubernetes spreads failures across pods, nodes, and the control plane, which makes root-causing them slow. Our troubleshooting guide covers the most common errors (CrashLoopBackOff, ImagePullBackOff, OOMKilled, stuck rollouts) with the commands to fix each one fast. graylog.org/post/kuberne...

SIEM shopping in 2026? Start here. Our State of SIEM Report ranks the year's Top 10 threats and lays out a 12-point checklist for lean security teams chasing faster detection without runaway costs. Full report: graylog.org/resources/st...

An audit trail without integrity can be altered. Without confidentiality, it's exposed to anyone. Both failures defeat the purpose. This new post covers audit log vs. audit trail, the 7 types of trails, and a 7-step implementation framework: graylog.org/post/protect...

Getting logs into Graylog doesn't require a PhD in syslog or other log sources. Sept 23, 10AM EDT: The Input Wizard, and the inputs pages 20 min content + 10 min Q&A. Make sure you're on the latest version. Register here: graylog.org/open-webinar

Check out free Graylog Academy. Self-paced courses covering log ingestion, pipeline rules, dashboards, and more. Built by the team behind the product. No catch. Start Learning: graylog.org/post/graylog...

Did you miss the webinar Zero to Logs with Graylog? - Installing Graylog in a Docker container - Getting logs into Graylog - Routing logs into dedicated streams Check out the replay here: graylog.org/resources/ze...

A login anomaly: risk-5. Ignored. Credential access five minutes after that: risk-72. Risk scoring turns 10,000 alerts into 10 critical investigations. Analysts investigate 3x more efficiently. Does your SIEM connect the dots, or just count them? Watch it happen: www.youtube.com/watch?v=O3Qc...

Configuration drift is quiet. No alarms go off when a system slowly stops matching its documented baseline. It just shows up later as a security gap, a failed audit, or an outage that takes hours to explain. This new blog post on why it happens and how to catch it early: graylog.org/post/recogni...

A service can be individually healthy and still be the reason everything else is timing out. Broke down 10 common micro-services issues and the specific signs that point to root cause, from cascade failures to contract drift to secrets management: graylog.org/post/trouble...

When the CI/CD pipeline fails, nobody ships. Environment mismatch. Expired credential. Flaky test. Full disk. The first error is rarely the trigger. Centralize logs. Confirm scope. Isolate what changed. Fix one variable at a time. graylog.org/post/buildin...

Sendmail logs auth failures, forged relay hostnames, TLS rejections, and Milter actions on every mail transaction. It's one of the most overlooked sources of threat telemetry out there. The Sendmail Content Pack for Graylog parses it. graylog.org/post/sendmai...

We are proud to power the NOC at @bsideslv.org, watching the traffic nobody else gets to see. #BSidesLV #graylog #NOC #cybersecurity #InfoSec

Graylog SIEM is working overtime in the NOC at @bsideslv.org 2026. Live conference traffic, real time processing, August 3-5 at The Tuscany. #BSidesLV #BSidesLV2026 #SIEM

Couldn't make it to our live session on the Graylog MCP Server? Good news, the recording is up. We showed how Graylog Open users can query logs using natural language through Claude. Check it out. Watch the replay: graylog.org/resources/co...

New blog: Understanding Compliance with GDPR Requirements. We cover the 7 GDPR principles, the articles that matter most, and how log monitoring helps organizations demonstrate compliance and catch incidents faster. graylog.org/post/underst... #GDPR #DataPrivacy #Compliance

Our next Graylog Open webinar covers the Graylog MCP Server: connect Claude, and query streams, indices, and login data with plain language prompts. July 29th 10am EDT. 20 min content + 10 min Q&A. Save your spot: graylog.org/open-webinar/

Lateral movement is how attackers quietly expand access after that first foothold, moving toward domain controllers, file shares, and databases while blending into legitimate traffic. This blog covers common techniques and the mitigation strategies to reduce risk graylog.org/post/lateral...

If you're running Suricata, you already have the data. The question is whether it's usable. Graylog's Suricata IDS/IPS Content Pack parses EVE JSON, normalizes it to GIM, and gives you a ready to use dashboard for alerts and more. graylog.org/post/suricat... #Graylog #Suricata #SIEM #NetworkSecurity

Credential phishing and malware attachments aren't going away. If you're using Mimecast for email security, Graylog 6.2.3+ lets you pull those logs in directly via API v2.0, with prebuilt Illuminate Dashboards ready on day one. New blog on setup and what you get: graylog.org/post/unlock-...

Remember cramming for exams, pulling together every note so you'd have the right info when it mattered? That's basically what preparing for an IT audit feels like, just with higher stakes. Check it out! graylog.org/post/it-audi...

New from Graylog Labs: the AWS WAF Content Pack. It parses your WAF JSON logs, normalizes HTTP request and enforcement fields, and maps block/allow/CAPTCHA/challenge events to GIM so they show up as real detections, not just raw JSON. graylog.org/post/aws-waf...

New on the Graylog blog: Building Efficient Cyber Investigation Workflows. We break down the 5 stages of a cyber investigation (identification, preservation, analysis, documentation, presentation) plus best practices for centralizing telemetry and reducing alert fatigue. graylog.org/post/buildin...

WinRM is built into Windows and beloved by attackers for lateral movement. Graylog's Microsoft WinRM Content Pack turns raw operational event logs into structure with security intelligence, parsing, enrichment, and a dashboard included. graylog.org/post/microso... #Graylog #WinRM #SIEM

SOC 2 isn't a point-in-time exercise, it's continuous. Our definitive guide walks through every criteria, control, and best practice your team needs to stay audit-ready and demonstrate operating effectiveness all year long. Link: graylog.org/post/the-def...

48 teams. Half the planet watching. The World Cup creates conditions that financially motivated attackers exploit by design. Your security infrastructure either matches that preparation, or it doesn't. Link: graylog.org/post/the-wor...

CCoP 2.0 sets continuous monitoring requirements for Singapore's critical infrastructure — but most orgs are still treating compliance as a checkbox. In July 2025, a Chinese-linked APT operated inside all four major Singapore telcos, undetected. New blog: Link: graylog.org/post/what-si...

Protecting the electric grid means complying with NERC CIP, 13 standards covering physical security, patch management, incident response, and more. Our blog explains what each standard requires and how a SIEM supports compliance without the overhead. graylog.org/post/ferc-an...

Audit readiness is a sales strategy, not just a security one. When your controls, logs, and evidence are always organized and accessible, audits move faster, costs drop, and customers sign sooner. New post from on making audit readiness a business advantage: graylog.org/post/why-aud...