Collecting every log is like looting every item in an RPG. Eventually your storage fills up and the bill arrives. Data pipeline management lets you route, normalize, and tier your security data so you keep visibility without paying to store noise. graylog.org/post/data-pipeli…

Miss the Graylog Inputs Demystified webinar? Watch the replay here: graylog.info/4jixvNc

Linux runs more of your IT environment than you think. Here are 25 Linux logs you should be collecting and monitoring, plus the terminal commands to read them. graylog.org/post/25-linux-lo…

Suricata throws off a ton of EVE JSON data. Graylog's Suricata IDS/IPS Content Pack parses, enriches, and maps it to GIM so your team gets instant IDS/IPS visibility instead of a wall of raw alerts. graylog.org/post/suricata-id… #Graylog #Suricata #SIEM #InfoSec

Ephemeral containers. Fragmented tools. Alert fatigue. Cloud-native APM has problems monolithic systems never did. Our new guide breaks down 5 best practices for engineering leaders managing distributed systems. graylog.org/post/what-is-app…

Getting logs into Graylog doesn't require a PhD in syslog or other log sources. Sept 23, 10AM EDT: The Input Wizard, and the inputs pages 20 min content + 10 min Q&A. Make sure you're on the latest version. Register here: graylog.org/post/inputs-demy…

Syslog on Linux isn't one thing. Different daemons, different file paths, different defaults across Ubuntu, RHEL, Debian, and Arch. Our guide covers how to find, configure, and centralize Linux syslog data. graylog.org/post/a-practical…

The electric grid isn't just a physical target, it's a cyber one. NERC CIP sets 13 enforceable standards covering everything from access controls to supply chain risk. Our latest blog maps out what energy sector orgs need to monitor and why. graylog.org/post/ferc-and-ne…

Kubernetes troubleshooting is hard because the errors rarely stay in one place. Our new guide covers CrashLoopBackOff, OOMKilled, stuck rollouts, DNS failures, and more, plus the exact kubectl commands to diagnose each one. graylog.org/post/kubernetes-…

Ransomware. Identity attacks. Third-party risk. Our 2026 State of SIEM Report ranks the year's Top 10 threats and gives lean security teams a 12-point buying checklist for faster detection without runaway costs. Read now: graylog.org/resources/state-…

Audit trails face the same two failure modes. New post on why protecting the audit trail means protecting both: graylog.org/post/protection-…

Getting logs into Graylog doesn't require a PhD in syslog or other log sources. Sept 23, 10AM EDT: The Input Wizard, and the inputs pages 20 min content + 10 min Q&A. Make sure you're on the latest version. Register here: graylog.org/open-webinar

Check out free Graylog Academy. Self-paced training on everything from log ingestion to pipeline rules, built by the Graylog team. No catch. Start here: graylog.org/post/graylog-aca…

Did you miss the webinar Zero to Logs with Graylog? - Installing Graylog in a Docker container - Getting logs into Graylog - Routing logs into dedicated streams Check out the replay here: graylog.info/3T0Mf8N

Host-based detection often sits at the edge of SOC. The OSSEC HIDS Content Pack for Graylog changes that. Visibility into file integrity, auth events, and active responses. https://graylog.orhttps://graylog.info/4xQFaGD

A login anomaly: risk-5=Ignored. Credential access five minutes after that: risk-72. Risk scoring turns 10,000 alerts into 10 critical investigations. Does your SIEM connect the dots, or just count them? youtube.com/watch?v=O3Qcgbh8…

You downloaded Graylog Open. Now what? Zero to Logs: Graylog Open Running Under an Hour walks you through a real install from scratch. Deployment choice, first data source, first search. No slides, no theory. Just a live terminal. Wed Aug 26, 10AM EDT. graylog.org/open-webinar/

Configuration drift doesn't announce itself. It builds from small manual fixes and hotfixes until your systems no longer match their documented baseline. We break down the causes, the risks, and how to catch it before it becomes an incident. graylog.org/post/recognizing…

Microservices architecture trades one big problem (the monolith) for ten smaller ones that are harder to find. We covered the top 10 microservices issues and what to look for when debugging each one: graylog.org/post/troubleshoo…

When the CI/CD pipeline fails, nobody ships. The first error shown is rarely the actual root cause. Centralize your logs. Confirm scope. Fix one variable at a time. graylog.org/post/building-a-… #DevOps #CICD