Graylog

Graylog is log management and SIEM software for IT operations and security teams, run self-managed or on Graylog Cloud, with a source-available free edition.

Graylog gathers logs from servers, applications, network devices and cloud services so teams can search, chart and alert on them in one place. Graylog, Inc., an independent company in Houston, Texas, develops it. The project began in 2009 as open source log management and grew into a SIEM on the same codebase. That lets one store of log data serve both troubleshooting and threat detection. Data arrives through inputs for Syslog, GELF, Beats, CEF and Netflow, and Graylog Sidecar manages collectors such as Filebeat and Winlogbeat on each host. Processing pipelines extract fields with Grok and regex rules, redact sensitive values and drop noisy messages before storage. Streams route each message to an index or a data lake, and search filters on the parsed fields. Dashboards turn saved searches into shared widgets, while event definitions raise alerts with notifications by email, Slack or HTTP. Graylog Enterprise adds hot, warm and archive tiering, the correlation engine and scheduled reports, and Graylog Security adds MITRE ATT&CK detection rules, Sigma support, anomaly detection and AI incident reports. Graylog Open fits teams with the engineering time to install, tune and maintain their own log platform, relying on community support. Graylog Enterprise is aimed at operations teams with retention and compliance duties. Graylog Security serves lean security teams that need a SIEM without a separate log pipeline. Organisations that cannot let logs leave their network run any edition on their own servers, and others choose Graylog Cloud. Teams moving to a paid edition scope it with the Graylog sales team. In an incident, analysts search the messages around an alert and work the case in an investigation timeline. Security teams pull Sigma rules from their own GitHub, GitLab or Bitbucket repositories into Graylog Security. Applications instrumented with OpenTelemetry send their logs over gRPC, and selected messages go on to another SIEM through GELF or TCP syslog outputs. Older data moves to Amazon S3, Google Cloud Storage or Azure Blob and returns for a search when an investigation reaches back past the hot tier.