Graylog

10/16/2026

Want to find out more about the latest Graylog 7.2 release? Sign up for the webinar here:
https://graylog.info/4ypu1MU

10/13/2026

What’s new in Graylog 7.2?

- Less time triaging alerts.
- Less time managing the platform.
- Direct control over the data flowing in.

Case-based triage, smarter admin tools, and the native Graylog Collector make it happen.

The Graylog 7.2 release brings new AI Agents as well as many new features. Checkout the release and information.

10/06/2026

Is your organization operating in India — or handling data of Indian residents? You need to understand the Digital Personal Data Protection Act (DPDPA).

India's landmark data privacy law establishes clear obligations for any organization that collects and processes personal data. Here's what you need to know:

Who must comply?
Any organization handling personal data — private companies, government bodies, startups, NGOs, platforms, and employers. There are even stricter obligations for organizations designated as "Significant Data Fiduciaries," including mandatory Data Protection Impact Assessments and an India-based Data Protection Officer.

How does it define personal data?
Broadly, any data that can directly or indirectly identify an individual, including when combined with other data points. This goes well beyond traditional sensitive data categories.

What rights do Data Principals have?
- Right to access information
- Right to correction, completion, and erasure
- Right to grievance redressal
- Right to nominate a representative

What security safeguards are required?
The DPDP Rules specify concrete measures: encryption, access controls, log monitoring, breach detection, data backups, and vendor contracts — all with a 72-hour breach notification requirement to India's Data Protection Board.

For security and compliance teams, a centralized SIEM with audit logging, user behavior monitoring, and automated compliance reporting is key to achieving and demonstrating DPDPA compliance.

Read our full breakdown of what the DPDPA means for your organization:
https://graylog.info/3VAm0XK

Understand India’s Digital Personal Data Protection Act (DPDPA), including key rights, obligations, and practical steps organizations can take to achieve compliance and strengthen data security.

10/01/2026

A single unlocked door is all an attacker needs.

Vulnerability exploitation is now the most common way attackers break in. The 2026 Data Breach Investigations Report found it was the initial access vector in 31% of breaches, overtaking credential abuse for the first time. Meanwhile, organizations fully remediated only 26% of known exploited vulnerabilities, and the median time to fix them grew to 43 days.

Scanning alone does not close that gap. A robust vulnerability management program does.
Our latest blog covers:
- The full vulnerability management lifecycle, from discovery to reporting
- How vulnerabilities, risks, and threats differ
- Why vulnerability management is more than a point-in-time assessment
- The common obstacles: executive buy-in, asset visibility, prioritization, and cross-team collaboration

It also shows how Graylog Security uses asset priority and asset risk scores to help teams focus on what matters most first.
Read the full post: https://graylog.info/3TgZ27r

As attackers increasingly target security weaknesses in operating systems, software, and firmware, an organization needs a robust vulnerability management program as part of its cybersecurity risk mitigation strategy.

09/30/2026

JSON has become a standard log format because it gives you structured data you can search, correlate, and analyze. Parsing it turns raw strings into usable objects, whether you're working in JavaScript, Python, PHP, or Java.

Our latest blog covers:
- What JSON is and why it's so widely used
- How to make JSON readable with pretty-printing and IDE tools
- Partial JSON parsing for extracting only the fields you need
- JSON logging best practices, from schema design to adding context like user and session IDs

Structured logs make security monitoring and troubleshooting faster. Start with the fundamentals here:
https://graylog.info/47rA7Bj

Parsing JSON involves transforming structured information into a format that can be used within various programming languages.

09/28/2026

Your Firebox logs every allowed and denied connection, every user logon, every IPS and gateway antivirus detection, and every configuration change. The WatchGuard Firebox Content Pack for Graylog Illuminate turns that raw Fireware syslog into structured, searchable security data.

The pack uses Fireware message IDs to map each event to the Graylog Information Model (GIM). Authentication, traffic, proxy, DHCP, audit, and detection events arrive normalized and ready to correlate with the rest of your environment.

What it gives your team:
- IPS, GAV, and APT detections surfaced as network detections
- Visibility into flood, scan, DDoS, and spoofing attacks
- DHCP events that tie an IP address back to a device
- Configuration change and signature update records for audit
- A Spotlight dashboard and saved searches

Read the full walkthrough: https://graylog.info/47o4msQ

Graylog's WatchGuard Firebox Content Pack parses Firebox syslog, normalizes traffic, auth, IPS, and DHCP events, mapping them to GIM for detection.

09/24/2026

In a lot of role-playing games, you loot everything until your inventory fills up. Then you have to decide what to keep, or pay for more storage.

Log data works the same way. SIEM and observability costs scale with volume, so collecting everything eventually forces hard choices between visibility and budget.

Data pipeline management changes that. By controlling data from collection through processing, routing, storage, and retrieval, teams can:
- Route data by priority, so high-value security events stay searchable and routine noise goes somewhere cheaper
- Normalize and enrich logs at ingest, so detections work consistently across every source
- Use hot, warm, and archive tiers to match storage cost to how the data is actually used
- Keep archived data retrievable for investigations and audits without a separate migration project

The result is faster detection, less alert fatigue, and compliance retention that doesn't blow up the budget.

Read the full breakdown: https://graylog.info/4hn1cdD

Learn how data pipeline management helps security and IT teams control SIEM costs, reduce alert fatigue, and stay audit-ready without losing visibility.

09/23/2026

Miss the Graylog Inputs Demystified webinar? Watch the replay here: https://graylog.info/4xFD6kc

09/21/2026

Linux logs are scattered across dozens of files, and knowing which ones matter is half the battle. Our new post breaks down 25 critical Linux logs to collect and monitor, from http://auth.log and secure to http://audit.log and wtmp, plus how to read them with tools like journalctl, grep, and awk.

If Linux runs part of your stack, this is worth bookmarking. Read it here: https://graylog.info/4rrGf5Z

Knowing what Linux logs to collect and monitor can help you correlate event information for improved operations and security insights.

09/17/2026

Suricata generates a lot of signal, alerts, anomalies, DNS, TLS, HTTP, flow data, and more, all packed into EVE JSON. The question is what your team does with it once it lands.

The Suricata IDS/IPS Content Pack for Graylog parses that EVE JSON output, normalizes it against the Graylog Information Model, and maps it into a ready to use dashboard. Alerts, flow events, file info, Kerberos tickets, and two dozen other protocols get structured and correlated automatically, so your analysts spend less time normalizing data and more time investigating it.

Read how it works, including setup with Filebeat and syslog, GIM categorization, and real detection use cases: https://graylog.info/4hdCFHE

Graylog Suricata IDS/IPS Content Pack parses, enriches, and maps EVE JSON logs for instant network security visibility and threat detection.