mastodon 4.8.0-alpha.3+glitchCentralized #logmanagement that actually works. #cybersecurity #infosec
GDPR compliance isn't a one time checklist, it's ongoing monitoring and documentation.
Our latest blog walks through the 7 core principles, key articles like breach notification and DPIAs, and how centralized log management helps organizations stay audit ready and respond to incidents within GDPR's 72-hour window.
https://graylog.org/post/understanding-compliance-with-gdpr-requirements/
🌡️ New lab guide: hook up an ESP32 + DHT22 sensor, create a tiny HTTP endpoint, and stream live temperature & humidity data straight into Graylog for a real-time dashboard.
Who said log management couldn't be fun? 🛠️
👉 https://graylog.org/post/iot-sensor-lab-guide/
#Graylog #IoT #HomeLab #ESP32 #LogManagement #DIY #MakerCommunity
On the Graylog blog: a full breakdown of FERC and NERC CIP compliance for the energy sector.
This covers all 13 enforceable standards, from BES Cyber System categorization to supply chain risk management, and how security monitoring ties it together.
New guide: managing Linux syslog across mixed environments.
This covers the daemons (syslogd, rsyslog, syslog-ng, journald), where each distro stores logs, common challenges like permission issues and log rotation data loss, and best practices for configuring and centralizing syslog data.
https://graylog.org/post/a-practical-guide-for-managing-linux-syslog/
On the Graylog blog:
a full breakdown of FERC and NERC CIP compliance for the energy sector. Covers all 13 enforceable standards, from BES Cyber System categorization to supply chain risk management, and how security monitoring ties it together.
New guide: Kubernetes Troubleshooting, The Complete Guide.
Covers the most common Kubernetes errors (CrashLoopBackOff, ImagePullBackOff, OOMKilled, Node Not Ready, stuck rollouts, DNS resolution failures) with root causes and diagnostic commands for each.
Also breaks down the three pillars of troubleshooting: understanding, management, and prevention, plus best practices for centralizing logs and building alerts that catch failures early.
https://graylog.org/post/kubernetes-troubleshooting-the-complete-guide/
WatchGuard Firebox Firewall Data in Graylog:
Your Firebox records every allowed and denied connection, user logon, IPS detection, and configuration change. The Graylog Illuminate content pack parses that Fireware syslog using message IDs and maps it to GIM.
https://graylog.org/post/watchguard-firebox-firewall-data-in-graylog/
New webinar: Graylog MCP Server How-To.
Jeff Darrington shows Graylog Open users how to query streams, indices, and log data through Claude using natural language.
July 29th 10AM, 20 min content, 10 min Q&A. Part of our Getting the Most out of Graylog Open series.
https://graylog.org/open-webinar/
Storing every log forever? That's not security — that's a storage bill.
Effective log retention means tiering your data: hot for active monitoring, warm for periodic audits, cold for long-term compliance.
The right strategy keeps the signal, cuts the noise, and scales without breaking your budget.
New guide on building a cost-effective log retention strategy: https://graylog.org/post/how-to-build-a-cost-effective-log-retention-strategy/
Ten common micro-services issues, broken down by what to actually look for when debugging each one.
Covers distributed tracing gaps, cascade failures, API contract drift, deployment coordination, secrets management, service discovery, and more.
https://graylog.org/post/troubleshooting-the-top-10-microservices-issues/
Cloud-native APM comes with challenges monolithic systems didn't have: ephemeral infrastructure, tool sprawl, telemetry costs outpacing budget, and alert fatigue that buries the signal that matters.
Our new guide covers what APM is, how it differs from monitoring and observability, the direct and hidden costs of getting it wrong, and 5 best practices for engineering teams running distributed systems.
https://graylog.org/post/what-is-application-performance-management/
#APM #Observability #CloudNative #DevOps
New post: IT Audit: What It Is and How to Prepare for One
Covers the security/risk, compliance/governance, and operational continuity objectives auditors assess, plus where IT audits overlap with (and differ from) traditional financial audits.
It also digs into the tooling stack auditors expect to see evidence from: SIEM, vulnerability scanners, IAM, EDR, DLP, and audit logging platforms, and how centralized log management (hi, Graylog) cuts down the manual evidence-gathering work for lean security teams.
https://graylog.org/post/it-audit-what-it-is-and-how-to-prepare-for-one/
#ITAudit #Cybersecurity #Compliance #SIEM
Linux logs live in /var/log with no consistent naming convention, which makes them easy to overlook.
We rounded up 25 worth collecting and monitoring, along with the commands to read them.
https://graylog.org/post/25-linux-logs-to-collect-and-monitor/
Configuration drift happens quietly. A manual fix here, a hotfix there, a deployment that misses part of the fleet. Over time the gap between documented baseline and actual state grows until it surfaces as a security gap, a compliance failure, or an outage.
This new blog post covers the root causes and the practices that catch drift early, including baselining, continuous monitoring, and centralized logging.
https://graylog.org/post/recognizing-and-mitigating-configuration-drift-risks/
When the CI/CD pipeline fails, everyone stops shipping and starts guessing.
Environment mismatches, expired credentials, flaky tests, infrastructure issues. The first error message is rarely the real root cause.
The fix isn't faster debugging. It's a repeatable investigation process: centralize logs from every pipeline stage, confirm scope, identify the failed step, isolate what changed.
Singapore's CCoP 2.0 isn't a once-a-year audit exercise. It mandates continuous monitoring, behavioral anomaly detection, and integrated IT/OT coverage for good reason.
In July 2025, a Chinese-linked APT group was found operating inside all four of Singapore's major telcos, using techniques that signature-based detection misses entirely.
New Graylog blog breaks down what CCoP 2.0 actually requires and includes six indicators to assess your detection posture before your next audit.
Link: https://graylog.org/post/what-singapores-ccop-2-0-requires-of-critical-infrastructure-owners/
Getting logs into Graylog doesn't require a PhD in syslog or other log sources.
Sept 23, 10AM EDT: The Input Wizard, and the inputs pages
20 min content + 10 min Q&A. Make sure you're on the latest version.
Register here:
Suricata produces rich network telemetry, alerts, anomalies, flow data, DNS, TLS, SSH, Kerberos, and more, but raw EVE JSON isn't investigation ready on its own.
The Suricata IDS/IPS Content Pack for Graylog parses, enriches, and maps that data to the Graylog Information Model, with a dashboard built in. Setup covers Filebeat via Sidecar or syslog forwarding.
Full breakdown here: https://graylog.org/post/suricata-ids-ips-data-in-graylog/
#Graylog #Suricata #SIEM #ThreatHunting #InfoSec #NetworkSecurity
Audit trails need two things working together: integrity (nothing alters the record) and confidentiality (only authorized people see it). Miss either one and the trail stops being useful evidence.
New post covers the difference between audit logs and audit trails, seven types of audit trails organizations generate, and a seven-step framework for building trail protection in from the start.
Read here:
https://graylog.org/post/protection-of-the-audit-trail-involves-both-integrity-and-confidentiality/
Check out free Graylog Academy.
Whether you are new to Graylog or looking to level up your skills, Academy offers self-paced training on log ingestion, pipeline rules, dashboards, and log source onboarding. It is built by the people who build the product.
No catch.
Start learning: https://graylog.org/post/graylog-academy-free-training-available/
#Graylog #SIEM #LogManagement #FreeTraining
The 2026 World Cup is the most complex digital event in history, and the threat window it creates isn't limited to FIFA.
Gaming platforms, payment processors, broadcasters, hospitality providers: all in scope.
A 30-second log delay means a stolen credential has 30 seconds of operational freedom before anyone sees the first signal.
That's not a performance issue. That's a security gap.
Link: https://graylog.org/post/the-world-cup-creates-the-worlds-largest-attack-surface/
#CyberSecurity #SIEM #SecurityOperations
SaaS-only SIEM fails the moment it assumes connectivity that doesn't exist.
Air-gapped military networks. OT-isolated pipelines and power grids. Government research enclaves. Hard data residency mandates across the EU, GCC, and beyond.
In each case the issue isn't the product — it's the architecture.
New post: the four environments where cloud-first SIEM structurally cannot operate, and what actually works instead → https://graylog.org/post/the-four-environments-where-saas-only-siem-fails/
Audit season doesn't have to mean panic mode.
Organizations that maintain audit readiness year-round spend less time scrambling for evidence, close deals faster, and demonstrate a mature security posture to customers and partners.
This blog covers practical steps, centralized log management, saved queries, retention policies, and more that turn audit prep from a fire drill into a repeatable workflow.
https://graylog.org/post/why-audit-readiness-accelerates-revenue/
WinRM is built into Windows and beloved by attackers for lateral movement.
Graylog's Microsoft WinRM Content Pack turns raw operational event logs into structured, GIM-tagged security intelligence, with parsing, enrichment, and a dashboard included.
Detect brute force, trace attacker paths, meet audit requirements.
https://graylog.org/post/microsoft-winrm-data-in-graylog/
#Graylog #WinRM #SIEM
SOC 2 compliance guide, no fluff: Trust Services Criteria explained, Common Criteria controls mapped, and practical best practices for log collection, anomaly detection, incident response, and access management.
Link: https://graylog.org/post/the-definitive-soc-2-compliance-guide/
You downloaded Graylog Open. Now what?
Zero to Logs: Graylog Open Running Under an Hour walks you through a real install from scratch. Deployment choice, first data source, first search. No slides, no theory. Just a live terminal.
Wed Aug 26, 10AM EDT.
Register: https://graylog.org/open-webinar/
