Graylog

08/12/2026

Configuration drift starts small. A quick manual fix here, a hotfix there, a deployment that doesn't quite reach every server in the fleet. None of it feels dangerous in the moment.

Then one day the gap between your documented baseline and your actual environment becomes a security incident, a failed audit, or an outage nobody can explain.

Our new blog post breaks down where drift comes from (manual changes, hotfixes, inconsistent deployments, disconnected tools, lack of version control) and the real risks it creates:
- Security vulnerabilities
- Compliance failures
- Slower deployments, and
- Harder incident response.

It also covers what actually works to catch it early:
- Establishing a real baseline
- Continuous monitoring
- Centralized logging, and
- Building drift detection directly into incident response.

Read the full breakdown:
https://graylog.info/4hvpFiC

08/10/2026

Microservices solve the tangled monolith problem. They also create ten new ways for things to break.

Distributed tracing gaps. Cascade failures. API contract drift. Secrets that expire without warning. Service discovery issues that look like network problems until they aren't.

Each of these has its own failure signature, and each one hides differently across a distributed system. We broke down what to look for in ten of the most common microservices issues, including the specific symptoms that point to root cause.

Read the full breakdown:

Distributed systems are powerful but notoriously hard to debug. Learn the 10 most common microservices troubleshooting challenges and what to look for when things go wrong in production.

07/29/2026

Miss our "Graylog MCP Server How-To" webinar?

That's ok. We walked through how Graylog Open users can query their logs using plain, natural language via Claude and Graylog's MCP server. Just ask the question and get the answer.

The recording is up now. If you're running Graylog Open or Enterprise and want an additional way to work with your log data, check it out!
https://graylog.info/4wx0Uav

07/28/2026

GDPR set the global benchmark for data privacy when it took effect in 2018, and it's still one of the strictest regulations organizations have to navigate today.

Our latest blog breaks down what GDPR actually requires: the seven core principles (from data minimization to accountability), key articles like breach notification and Data Protection Impact Assessments, and the fines organizations face for falling short.

We also cover how centralized log management supports ongoing GDPR compliance, from capturing detailed access records to meeting that 72-hour breach notification window.

Read the full breakdown: https://graylog.info/3RlDYvv

Understand GDPR requirements in plain terms: what data is covered, who must comply, key articles, and how to monitor for compliance.

07/17/2026

New in the Getting the Most out of Graylog Open series: Graylog MCP Server How-To.
Ever wished you could just ask Graylog a question instead of building a search? This session shows you how.

Jeff Darrington walks through:
- Connecting Claude to Graylog via MCP server
- Configuring the connection and securing a connection from Claude CLI
- Running real natural language queries against streams, indices, and log data.

You will see live prompts pulling login activity and searching across indices conversationally, plus the common setup issues to watch for and where to get help if you hit a snag.

- 20 minutes of content,
- 10 minutes of live Q&A.
- Built for Graylog Open users who want a faster way to explore their data.
- July 29th 10AM EDT

Register here: https://graylog.info/4yr1yrl

07/16/2026

Once attackers get past your perimeter, the real fight begins.

Lateral movement is how threat actors quietly pivot from a single compromised endpoint toward domain controllers, file shares, and database servers, all while blending into normal admin activity.

Our new blog breaks down the techniques attackers rely on, including pass the hash, RDP abuse, PowerShell abuse, and Kerberos ticket theft, plus the detection and mitigation strategies that actually work: network segmentation, least privilege access, MFA, PAM, and Zero Trust.

Read the full breakdown of lateral movement risks and how Graylog helps reduce dwell time:
https://graylog.info/4fAYX6F

07/14/2026

Suricata generates a lot of signal, alerts, anomalies, DNS, TLS, HTTP, flow data, and more, all packed into EVE JSON. The question is what your team does with it once it lands.

The Suricata IDS/IPS Content Pack for Graylog parses that EVE JSON output, normalizes it against the Graylog Information Model, and maps it into a ready to use dashboard. Alerts, flow events, file info, Kerberos tickets, and two dozen other protocols get structured and correlated automatically, so your analysts spend less time normalizing data and more time investigating it.

Read how it works, including setup with Filebeat and syslog, GIM categorization, and real detection use cases: https://graylog.info/4phjEI0

Graylog Suricata IDS/IPS Content Pack parses, enriches, and maps EVE JSON logs for instant network security visibility and threat detection.

07/09/2026

Email remains one of the most exploited entry points for attackers, from credential phishing to malware-laced attachments. If your organization uses Mimecast, you already have strong telemetry on blocked threats, quarantined messages, and impersonation attempts. The question is whether that data is isolated or connected to the rest of your security stack.

Starting with Graylog 6.2.3, you can pull Mimecast logs directly via API v2.0 and view them immediately with prebuilt Illuminate Dashboards. No manual dashboard building, no pivoting between tools during an investigation.
In our latest blog, we cover:
1. Why centralizing email security data with endpoint, firewall, and identity logs matters
2. Prerequisites for the Mimecast API integration
3. How to configure the Graylog input
4. What the Illuminate Technology Pack and dashboards give your analysts out of the box

Read the full breakdown here: https://graylog.info/4vis2bx

Integrate Mimecast with Graylog to centralize email threat logs, speed investigations, and gain instant insights via Illuminate Dashboards.

07/07/2026

IT audits are shifting from a check-the-box compliance exercise to a strategic tool for security assurance.

The comparison is a familiar one: think back to cramming for a final exam. You gather every note, every review sheet, hoping you have the right information at your fingertips when it counts. An IT audit works the same way for your organization, except instead of a letter grade, the stakes are data breaches, operational downtime, and regulatory penalties.

Our latest blog breaks down what an IT audit actually evaluates, including:
- Security and risk management controls like MFA
- Access permissions, and vulnerability management
- Compliance and governance objectives tied to frameworks like SOC 2, NIST CSF, and PCI DSS
- Operational resilience factors like disaster recovery and business continuity planning

We also cover how IT audits differ from traditional financial audits, and where the two increasingly overlap as financial systems lean more heavily on technology infrastructure.

For lean IT and security teams, tools like SIEM platforms play a critical role in audit readiness. Centralized log data, automated reporting, and searchable audit trails mean less time spent manually gathering evidence and more time addressing the risks that actually matter.

Read the full breakdown to see how to prepare your organization for its next IT audit.

Learn what an IT audit is, its core objectives, key differences from financial audits, and the tools organizations use to improve security, compliance, and audit readiness.

07/02/2026

Is your AWS WAF telling you the whole story?
AWS WAF sits in front of your Application Load Balancers, CloudFront, API Gateway, and AppSync, blocking, allowing, counting, and challenging traffic in real time. But those enforcement decisions are only useful if your security team can see them.

The new AWS WAF Content Pack for Graylog turns raw WAF JSON logs into structured, searchable security intelligence:
1. Automatic parsing of the WAF JSON payload into normalized HTTP and enforcement fields
2. GIM categorization so BLOCK, CAPTCHA, and CHALLENGE actions surface as detections
3. A Spotlight dashboard summarizing WAF activity out of the box
4. No manual field extraction or stream rules required

Available with Illuminate and Graylog Enterprise or Graylog Security.
Read how it works: https://graylog.info/4y01H4N

Graylog's AWS WAF Content Pack parses, enriches, and maps WAF block, allow, and challenge events for instant application security visibility.