Graylog
@graylog.bsky.social
🌍 Trusted Threat Detection & Incident Response solutions. Experience the difference with our unmatched capabilities. #SIEM #APISecurity #LogManagement #InfoSec
Sendmail logs auth failures, forged relay hostnames, TLS rejections, and Milter actions on every mail transaction. It's one of the most overlooked sources of threat telemetry out there. The Sendmail Content Pack for Graylog parses it. graylog.org/post/sendmai...
Sendmail Data In Graylog
Graylog Sendmail Content Pack parses, enriches, and maps mail server logs to GIM, turning routine MTA data into real threat detection signal."
graylog.org
We are proud to power the NOC at @bsideslv.org, watching the traffic nobody else gets to see. #BSidesLV #graylog #NOC #cybersecurity #InfoSec
Graylog SIEM is working overtime in the NOC at @bsideslv.org 2026. Live conference traffic, real time processing, August 3-5 at The Tuscany. #BSidesLV #BSidesLV2026 #SIEM
Couldn't make it to our live session on the Graylog MCP Server? Good news, the recording is up. We showed how Graylog Open users can query logs using natural language through Claude. Check it out. Watch the replay: graylog.org/resources/co...
New blog: Understanding Compliance with GDPR Requirements. We cover the 7 GDPR principles, the articles that matter most, and how log monitoring helps organizations demonstrate compliance and catch incidents faster. graylog.org/post/underst... #GDPR #DataPrivacy #Compliance
Understanding Compliance with GDPR Requirements
Understand GDPR requirements in plain terms: what data is covered, who must comply, key articles, and how to monitor for compliance.
graylog.org
Our next Graylog Open webinar covers the Graylog MCP Server: connect Claude, and query streams, indices, and login data with plain language prompts. July 29th 10am EDT. 20 min content + 10 min Q&A. Save your spot: graylog.org/open-webinar/
Lateral movement is how attackers quietly expand access after that first foothold, moving toward domain controllers, file shares, and databases while blending into legitimate traffic. This blog covers common techniques and the mitigation strategies to reduce risk graylog.org/post/lateral...
Lateral Movement: Security Risk and Mitigation Strategies
Learn how lateral movement enables attackers to expand access across enterprise systems and how strong security controls can reduce dwell time and limit the impact of cyber attacks, phishing attacks, and ransomware attacks.
graylog.org
If you're running Suricata, you already have the data. The question is whether it's usable. Graylog's Suricata IDS/IPS Content Pack parses EVE JSON, normalizes it to GIM, and gives you a ready to use dashboard for alerts and more. graylog.org/post/suricat... #Graylog #Suricata #SIEM #NetworkSecurity
Suricata IDS/IPS Data in Graylog
Graylog Suricata IDS/IPS Content Pack parses, enriches, and maps EVE JSON logs for instant network security visibility and threat detection.
graylog.org
Credential phishing and malware attachments aren't going away. If you're using Mimecast for email security, Graylog 6.2.3+ lets you pull those logs in directly via API v2.0, with prebuilt Illuminate Dashboards ready on day one. New blog on setup and what you get: graylog.org/post/unlock-...
Unlock Email Threat Visibility with Mimecast and Graylog
Integrate Mimecast with Graylog to centralize email threat logs, speed investigations, and gain instant insights via Illuminate Dashboards.
graylog.org
Remember cramming for exams, pulling together every note so you'd have the right info when it mattered? That's basically what preparing for an IT audit feels like, just with higher stakes. Check it out! graylog.org/post/it-audi...
IT Audit: What It Is and How to Prepare for One
Learn what an IT audit is, its core objectives, key differences from financial audits, and the tools organizations use to improve security, compliance, and audit readiness.
graylog.org
New from Graylog Labs: the AWS WAF Content Pack. It parses your WAF JSON logs, normalizes HTTP request and enforcement fields, and maps block/allow/CAPTCHA/challenge events to GIM so they show up as real detections, not just raw JSON. graylog.org/post/aws-waf...
AWS WAF Data in Graylog
Graylog's AWS WAF Content Pack parses, enriches, and maps WAF block, allow, and challenge events for instant application security visibility.
graylog.org
New on the Graylog blog: Building Efficient Cyber Investigation Workflows. We break down the 5 stages of a cyber investigation (identification, preservation, analysis, documentation, presentation) plus best practices for centralizing telemetry and reducing alert fatigue. graylog.org/post/buildin...
Building Efficient Cyber Investigation Workflows
Learn how to build efficient cyber investigation workflows for lean security teams by centralizing telemetry, improving threat detection, and streamlining incident response.
graylog.org
WinRM is built into Windows and beloved by attackers for lateral movement. Graylog's Microsoft WinRM Content Pack turns raw operational event logs into structure with security intelligence, parsing, enrichment, and a dashboard included. graylog.org/post/microso... #Graylog #WinRM #SIEM
Microsoft WinRM Data in Graylog
Graylog Microsoft WinRM log monitoring content parses, enriches, and maps Windows Remote Management logs giving your team instant security visibility.
graylog.org
SOC 2 isn't a point-in-time exercise, it's continuous. Our definitive guide walks through every criteria, control, and best practice your team needs to stay audit-ready and demonstrate operating effectiveness all year long. Link: graylog.org/post/the-def...
The Definitive SOC 2 Compliance Guide
A complete guide to SOC 2 compliance that covers the Trust Services Criteria, Common Criteria, Type 1 vs. Type 2 reports, and best practices for maintaining audit readiness year-round.
graylog.org
48 teams. Half the planet watching. The World Cup creates conditions that financially motivated attackers exploit by design. Your security infrastructure either matches that preparation, or it doesn't. Link: graylog.org/post/the-wor...
The World Cup Creates the World's Largest Attack Surface
48 teams, 104 matches, half the planet watching—and threat actors ready. Is your security infrastructure built for what that window demands?
graylog.org
CCoP 2.0 sets continuous monitoring requirements for Singapore's critical infrastructure — but most orgs are still treating compliance as a checkbox. In July 2025, a Chinese-linked APT operated inside all four major Singapore telcos, undetected. New blog: Link: graylog.org/post/what-si...
What Singapore's CCoP 2.0 Requires of Critical Infrastructure Owners
Understand CCoP 2.0's continuous monitoring and OT security requirements—and why Singapore's CII owners can't treat compliance as a checkbox.
graylog.org
Protecting the electric grid means complying with NERC CIP, 13 standards covering physical security, patch management, incident response, and more. Our blog explains what each standard requires and how a SIEM supports compliance without the overhead. graylog.org/post/ferc-an...
FERC and NERC: Cyber Security Monitoring for The Energy Sector
NERC CIP provides the basic cybersecurity control requirements for North American energy companies. Follow this blog for more info.
graylog.org
Audit readiness is a sales strategy, not just a security one. When your controls, logs, and evidence are always organized and accessible, audits move faster, costs drop, and customers sign sooner. New post from on making audit readiness a business advantage: graylog.org/post/why-aud...
Why Audit Readiness Accelerates Revenue
Discover how audit readiness accelerates revenue by reducing delays, streamlining compliance, strengthening controls, and building trust with customers, auditors, and stakeholders.
graylog.org
SaaS-only SIEM doesn't fail because the product is bad. It fails because the architecture assumes connectivity that some environments structurally cannot provide. Four of those environments — and what "run anywhere" actually requires 👇 graylog.org/post/the-fou...
The Four Environments Where SaaS-Only SIEM Fails
Air-gapped deployments, critical infrastructure, and data residency mandates expose the limits of SaaS SIEM. See the four environments where on-premises wins.
graylog.org
Most orgs either over-retain logs (expensive) or under-retain them (risky). The sweet spot? Tiered storage + clear policies + automated lifecycle management. New guide: how to build a cost-effective log retention strategy that actually scales 👇 graylog.org/post/how-to-...
How to Build a Cost-Effective Log Retention Strategy
Log retention policies help organizations control how long logs are kept, where they’re stored, and when they’re deleted or archived. Learn the key steps, common challenges, and best practices for com...
graylog.org
Turns out Graylog makes a surprisingly great IoT dashboard 🌡️ New lab guide: ESP32 + DHT22 sensor → HTTP API → live Graylog dashboard. Low cost, hands-on fun, and you'll actually learn something. 🔧 graylog.org/post/iot-sensor-lab-guide/ #IoT #HomeLab #ESP32 #Graylog
IoT Sensor Data into Graylog: A Lab Guide
Here's a howto for an IoT Sensor and sending data into Graylog. Attached is a DIY Lab Guide With an ESP32 Board for your next lab project.
graylog.org
Graylog is recognized as an Aspiring vendor in the 2026 Gartner®️ SIEM Voice of the Customer report, with an 86% willingness to recommend (based on 52 reviews as of Jan 2026). Access the report. Link: graylog.org/post/graylog...
Graylog Recognized by Users in the 2026 Gartner®️ SIEM VOC
Graylog recognized as an Aspiring vendor in the 2026 Gartner®️ SIEM Voice of the Customer report, with an 86% willingness to recommend (based on 52 reviews as of Jan 2026). Access the report.
graylog.org
Audit season got you anxious? We just dropped a whitepaper on 15 IT audit risks — covering identity, asset management, monitoring gaps, and config drift. Practical mitigations, not just theory. Built for lean teams in complex environments. Read it here → graylog.org/resources/15...
Ebook: 15 IT Audit Risks and Tactical Mitigation Strategies
Preparing for an IT audit? This Graylog guide covers 15 of the most common IT audit risks across identity and access management, asset management, security monitoring, and change and configuration man...
graylog.org
Misconfigured cloud? That's how most breaches start. We mapped out 15 of the riskiest cloud misconfigurations — from overpermissive IAM roles to public S3 buckets to disabled logging — plus how to find and fix each one. graylog.org/post/15-risk...
15 Risky Cloud Misconfigurations and How To Mitigate Them
Learn the most common cloud misconfigurations, why they are risky, and practical ways security teams can identify and remediate cloud security risks.
graylog.org
Most Windows environments are logging, but not watching the right things. Logons, privilege use, account changes, scheduled tasks, policy tampering, AD trust changes, AV telemetry. What's your SIEM actually alerting on? Link: graylog.org/post/critica... #CyberSecurity #BlueTeam #SIEM
Critical Windows Event ID's to Monitor
MIcrosoft offers a wide array of business critical technology solutions and logging capabilities to help manage security which can become overwhelming. This list of critical Event IDs to monitor can h...
graylog.org
India's Digital Personal Data Protection Act (DPDPA) is here — and it applies to any org handling Indian residents' data. Link: graylog.org/post/indias-... #DPDPA #DataPrivacy #Cybersecurity
India's Data Protection Law: The Digital Personal Data Protection Act
Understand India’s Digital Personal Data Protection Act (DPDPA), including key rights, obligations, and practical steps organizations can take to achieve compliance and strengthen data security.
graylog.org
Missed the Graylog 7.1 webinar? 🎬 The replay is live! Case-based triage, automatic investigations, Impossible Travel detection, dynamic sharding & more — all in 30 minutes. Watch on-demand → graylog.org/resources/we... #Graylog #LogManagement #Cybersecurity
Webinars: Webinar: What's New in 7.1
Graylog 7.1 is built for lean security and IT operations teams who need real outcomes, not more tools, more add-ons, or more manual work. This 30-minute deep dive session covers what's new and what it...
graylog.org
The Australian Information Security Manual (ISM) was updated in Dec 2025, now covering AI, cloud, and modern threats. It's a risk-based framework across 6 principles: Govern, Identify, Protect, Detect, Respond, and Recover. link: graylog.org/post/underst... #CyberSecurity #InfoSec #ISM
Understanding the Australian Information Security Manual (ISM)
Master Australian ISM compliance with centralized logging, real-time dashboards, and incident workflows. Discover must-have SIEM capabilities for audit logging, threat detection, and forensic readines...
graylog.org
OWASP dropped in 2026, the Top 10 for Agentic AI 🚨 The threat landscape for agentic systems goes way beyond prompt injection. Worth a read if you're building with AI agents. 🔗 graylog.org/post/what-is... #AgenticAI #OWASP #CyberSecurity #AppSec #LLMSecurity
What is the OWASP Top 10 Agentic AI
Explore OWASP’s 2025 Agentic AI Threats & Mitigations Guide. View the top risks of autonomous AI agent and strategies to secure multi-agent systems and safeguard data.
graylog.org
Less tools. Less manual work. Real outcomes. Graylog 7.1 is built for lean security and IT ops teams — and we're showing it live in a free 30-minute session on May 19. 📅 Tuesday, May 19, 2026 | 11:00 AM EDT Register for the webinar below 👇 events.zoom.us/ev/Agtev9ELa...
What's New in Graylog 7.1?
events.zoom.us