← Feed

Posts

• View post

  What to know about parsing JSON: JSON parsing converts strings into structured objects your code can work with. It supports data interchange, reduces injection risk by enforcing expected formats, and makes logs far easier to search. The blog covers readability techniques, partial parsing, language-specific methods, and JSON logging best practices like flattening structures and keeping data types uniform per field. https://graylog.org/post/what-to-know-parsing-json/ #JSON #Logging #InfoSec #SysA...

• View post

  India's DPDPA sets strict rules for any organization processing personal data of Indian residents, think GDPR, but with its own unique twist. Consent, access rights, breach notification within 72 hours, and enhanced obligations for "Significant Data Fiduciaries." We break it all down, including what security safeguards are required under the Rules. https://graylog.org/post/indias-data-protection-law-the-digital-personal-data-protection-act/ #DPDPA #DataPrivacy #InfoS...

• View post

  Logging Windows events isn't enough. You need to know which categories actually matter. Logon events, privilege use, account lifecycle, scheduled task abuse, audit policy changes, AD trust modifications, and AV telemetry each map to real attacker techniques. Gap in any one of them = blind spot an adversary will exploit. Is your log management platform covering all the bases? https://graylog.org/post/critical-windows-event-ids-to-monitor/ #InfoSec #CyberSecurity #BlueTeam #SIEM #Wind...

• View post

  What’s new in Graylog 7.2? - Less time triaging alerts. - Less time managing the platform. - Direct control over the data flowing in. Case-based triage, smarter admin tools, and the native Graylog Collector make it happen. https://graylog.org/post/graylog-7-2-ai-ready-triage-smarter-platform-management-and-the-new-graylog-collector/

• View post

  Want to find out more about Graylog 7.2 release? Sign up for the webinar here: graylog.org/open-webinar/

• View post

  A Sankey chart scales each link by the volume it carries, so an unusual flow between hosts stands out instead of hiding in a log table. Here’s how security teams use them for network traffic, authentication paths, attack paths, and log routing. https://graylog.org/post/how-security-teams-can-use-sankey-charts/

• View post

  PHP2Shell (CVE-2026-109618, CVE-2026-109619) is unauthenticated remote code execution in PHP core, and the default configuration is exposed. Parsing happens before your application runs, so route-scoped WAF rules never see it. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Then hunt. Attacks were reported before the patch shipped, so run these four Graylog searches across your full retention period, not just from today. https://graylog.org/post/detecting-php2shell-cves-with-graylog/

• View post

  Graylog 7.2 introduces Graylog Collector, a native log shipper you install once and manage entirely from the Graylog interface. Collectors join fleets through enrollment tokens. Sources for files, journald, Windows Event Log, and macOS unified logging are defined centrally and pushed live to every host in the fleet, with no restarts. Mixed OS fleets get the right sources for each host automatically. Our latest Graylog Labs post explains how it works and walks through installation and trouble...

• View post

  Check out free Graylog Academy. Whether you are new to Graylog or looking to level up your skills, Academy offers self-paced training on log ingestion, pipeline rules, dashboards, and log source onboarding. It is built by the people who build the product. No catch. Start learning: https://graylog.org/post/graylog-academy-free-training-available/ #Graylog #SIEM #LogManagement #FreeTraining

• View post

  Getting logs into Graylog doesn't require a PhD in syslog or other log sources. Sept 23, 10AM EDT: The Input Wizard, and the inputs pages 20 min content + 10 min Q&A. Make sure you're on the latest version. Register here: https://graylog.org/open-webinar

• View post

  Audit trails need two things working together: integrity (nothing alters the record) and confidentiality (only authorized people see it). Miss either one and the trail stops being useful evidence. New post covers the difference between audit logs and audit trails, seven types of audit trails organizations generate, and a seven-step framework for building trail protection in from the start. Read here: https://graylog.org/post/protection-of-the-audit-trail-involves-both-integrity-and-confidenti...

• View post

  New guide: Kubernetes Troubleshooting, The Complete Guide. Covers the most common Kubernetes errors (CrashLoopBackOff, ImagePullBackOff, OOMKilled, Node Not Ready, stuck rollouts, DNS resolution failures) with root causes and diagnostic commands for each. Also breaks down the three pillars of troubleshooting: understanding, management, and prevention, plus best practices for centralizing logs and building alerts that catch failures early. https://graylog.org/post/kubernetes-troubleshooting-the...

• View post

  On the Graylog blog: a full breakdown of FERC and NERC CIP compliance for the energy sector. Covers all 13 enforceable standards, from BES Cyber System categorization to supply chain risk management, and how security monitoring ties it together. https://graylog.org/post/ferc-and-nerc/

• View post

  New guide: managing Linux syslog across mixed environments. This covers the daemons (syslogd, rsyslog, syslog-ng, journald), where each distro stores logs, common challenges like permission issues and log rotation data loss, and best practices for configuring and centralizing syslog data. https://graylog.org/post/a-practical-guide-for-managing-linux-syslog/

• View post

  Cloud-native APM comes with challenges monolithic systems didn't have: ephemeral infrastructure, tool sprawl, telemetry costs outpacing budget, and alert fatigue that buries the signal that matters. Our new guide covers what APM is, how it differs from monitoring and observability, the direct and hidden costs of getting it wrong, and 5 best practices for engineering teams running distributed systems. https://graylog.org/post/what-is-application-performance-management/ #APM #Observabilit...

• View post

  Suricata produces rich network telemetry, alerts, anomalies, flow data, DNS, TLS, SSH, Kerberos, and more, but raw EVE JSON isn't investigation ready on its own. The Suricata IDS/IPS Content Pack for Graylog parses, enriches, and maps that data to the Graylog Information Model, with a dashboard built in. Setup covers Filebeat via Sidecar or syslog forwarding. Full breakdown here: https://graylog.org/post/suricata-ids-ips-data-in-graylog/ #Graylog #Suricata #SIEM #ThreatHunting #InfoSec...

• View post

  Linux logs live in /var/log with no consistent naming convention, which makes them easy to overlook. We rounded up 25 worth collecting and monitoring, along with the commands to read them. https://graylog.org/post/25-linux-logs-to-collect-and-monitor/

• View post

  WatchGuard Firebox Firewall Data in Graylog: Your Firebox records every allowed and denied connection, user logon, IPS detection, and configuration change. The Graylog Illuminate content pack parses that Fireware syslog using message IDs and maps it to GIM. https://graylog.org/post/watchguard-firebox-firewall-data-in-graylog/

• View post

  Data pipeline management for security and observability comes down to five stages: collection, processing, routing, storage, and retrieval. Get them right and you control ingestion costs, cut alert fatigue with cleaner data, meet retention requirements for frameworks like SOC 2 and PCI DSS, and keep archived logs searchable when you need them. Full post: https://graylog.org/post/data-pipeline-management-for-security-and-observability/ #SIEM #Observability #LogManagement #InfoSec

• View post

  Ten common micro-services issues, broken down by what to actually look for when debugging each one. Covers distributed tracing gaps, cascade failures, API contract drift, deployment coordination, secrets management, service discovery, and more. https://graylog.org/post/troubleshooting-the-top-10-microservices-issues/ #Microservices #Observability #DevOps #SIEM

• View post

  Configuration drift happens quietly. A manual fix here, a hotfix there, a deployment that misses part of the fleet. Over time the gap between documented baseline and actual state grows until it surfaces as a security gap, a compliance failure, or an outage. This new blog post covers the root causes and the practices that catch drift early, including baselining, continuous monitoring, and centralized logging. https://graylog.org/post/recognizing-and-mitigating-configuration-drift-risks/

• View post

  You downloaded Graylog Open. Now what? Zero to Logs: Graylog Open Running Under an Hour walks you through a real install from scratch. Deployment choice, first data source, first search. No slides, no theory. Just a live terminal. Wed Aug 26, 10AM EDT. Register: https://graylog.org/open-webinar/

• View post

  🌡️ New lab guide: hook up an ESP32 + DHT22 sensor, create a tiny HTTP endpoint, and stream live temperature & humidity data straight into Graylog for a real-time dashboard. Who said log management couldn't be fun? 🛠️ 👉 https://graylog.org/post/iot-sensor-lab-guide/ #Graylog #IoT #HomeLab #ESP32 #LogManagement #DIY #MakerCommunity

• View post

  Storing every log forever? That's not security — that's a storage bill. Effective log retention means tiering your data: hot for active monitoring, warm for periodic audits, cold for long-term compliance. The right strategy keeps the signal, cuts the noise, and scales without breaking your budget. New guide on building a cost-effective log retention strategy: https://graylog.org/post/how-to-build-a-cost-effective-log-retention-strategy/ #InfoSec #LogManagement #SIEM #Complian...

• View post

  SaaS-only SIEM fails the moment it assumes connectivity that doesn't exist. Air-gapped military networks. OT-isolated pipelines and power grids. Government research enclaves. Hard data residency mandates across the EU, GCC, and beyond. In each case the issue isn't the product — it's the architecture. New post: the four environments where cloud-first SIEM structurally cannot operate, and what actually works instead → https://graylog.org/post/the-four-environments-where-...

• View post

  Audit season doesn't have to mean panic mode. Organizations that maintain audit readiness year-round spend less time scrambling for evidence, close deals faster, and demonstrate a mature security posture to customers and partners. This blog covers practical steps, centralized log management, saved queries, retention policies, and more that turn audit prep from a fire drill into a repeatable workflow. https://graylog.org/post/why-audit-readiness-accelerates-revenue/

• View post

  On the Graylog blog: a full breakdown of FERC and NERC CIP compliance for the energy sector. This covers all 13 enforceable standards, from BES Cyber System categorization to supply chain risk management, and how security monitoring ties it together. https://graylog.org/post/ferc-and-nerc/

• View post

  Singapore's CCoP 2.0 isn't a once-a-year audit exercise. It mandates continuous monitoring, behavioral anomaly detection, and integrated IT/OT coverage for good reason. In July 2025, a Chinese-linked APT group was found operating inside all four of Singapore's major telcos, using techniques that signature-based detection misses entirely. New Graylog blog breaks down what CCoP 2.0 actually requires and includes six indicators to assess your detection posture before your...

• View post

  The 2026 World Cup is the most complex digital event in history, and the threat window it creates isn't limited to FIFA. Gaming platforms, payment processors, broadcasters, hospitality providers: all in scope. A 30-second log delay means a stolen credential has 30 seconds of operational freedom before anyone sees the first signal. That's not a performance issue. That's a security gap. Link: https://graylog.org/post/the-world-cup-creates-the-worlds-largest-attack-surface...

• View post

  SOC 2 compliance guide, no fluff: Trust Services Criteria explained, Common Criteria controls mapped, and practical best practices for log collection, anomaly detection, incident response, and access management. Link: https://graylog.org/post/the-definitive-soc-2-compliance-guide/ #SOC2 #Compliance #Cybersecurity #InfoSec