Graylog

Graylog is a log management and SIEM platform sold by Graylog, Inc., which lists offices in Houston, London and Hamburg. It collects log data from servers, network devices and applications, processes it through pipelines, and lets teams search it, build dashboards and raise alerts. The company sells it in three editions on one code base: Graylog Open, a free source-available edition under the Server Side Public License; Graylog Enterprise, for log management and compliance; and Graylog Security, which adds SIEM features such as maintained detection rules, risk scoring and guided investigations.

It also runs Graylog Cloud. The problem it targets is the cost of keeping and searching large volumes of logs. A built-in data lake holds data outside the licence count until someone retrieves it, and licences are priced on processed volume, not on devices or users. The same product can run self-managed, in the cloud or hybrid.

• Log collection and pipelines. Graylog Open accepts Syslog, CEF, GELF, Beats and Netflow, with Sidecar for managing collectors. Pipeline rules trim fields or drop events before processing, so noisy sources can stay connected without counting fully toward the licence.
• Data lake and tiering. Standby data can be routed to a data lake before licensing, searched with a preview, and retrieved selectively. Only retrieved data counts toward volume. Hot, warm and archive tiers are also described, with retention set by the customer when self-managed.
• Detection content. Graylog Security ships maintained detection rules mapped to MITRE ATT&CK, supports Sigma rules including private GitHub, GitLab or Bitbucket repositories, and shows a coverage map and log source gap analysis.
• Risk scoring and cases. Security edition scores assets and users, applies risk multipliers from campaign intelligence, asset history and vulnerability scans, and creates cases automatically with evidence attached. The vendor says this removes the need for a separate SOAR product.
• AI features and MCP. The vendor lists AI dashboard summaries, investigation summaries at case closure, natural-language queries through a built-in MCP server and a bring-your-own LLM option under role-based access controls. Open also exposes its back end through REST API and MCP.
• Deployment choice. Graylog runs self-managed, on Graylog Cloud or hybrid, and the vendor says features are the same across deployments. It also names EU-based OVH and Secunet SysEleven backends for tiered storage.

• A 15-person IT operations team. The team starts on Graylog Open to centralise server and firewall logs at no licence cost. When it needs data tiering or LDAP roles, it applies an Enterprise licence key to the same installation, which the vendor says needs no migration.
• A small security team without a SOC. Graylog Security's maintained rules, risk scores and automatic case creation aim to cut the manual work of triage. Sigma rule import lets the team reuse detection content from its own repository instead of writing everything in the product.
• A regulated company that must keep logs for years. Compliance data goes to the data lake and archive, outside active licensed volume. When an auditor asks, staff preview what is stored and retrieve only the needed records, which then count toward the licence for that period.

Graylog Open can be downloaded and run without a licence or a daily ingest cap. Paid editions start with a scoping call of about 20 minutes with a Graylog representative, after which you receive a quote. Every paid licence includes Graylog Accelerator, a guided onboarding service that runs through to production.

Self-paced training is open to anyone through Graylog Academy, while live and custom training, professional services and a named technical account manager are paid add-ons for licensed customers. For Security, the vendor describes deploying a first collector from the web interface. It does not publish a typical time to production.

Graylog Security has a published starting price for 10 GB a day, and its pricing FAQ says data routed to the data lake stays outside the licence until you retrieve it.

That makes long retention cheap, but data used for dashboards, reports or alerts must be processed and counted. The company is headquartered in Houston, with a German subsidiary in Hamburg. The Open edition is source-available under SSPL.

The SIEM software list places Graylog 2 of 12: Wazuh sits directly above it and Elastic Security directly below. Top-three spots are set aside for challengers, and Graylog holds one of them; read it as a position, not a grade.

Graylog is based in the United States; 10 of the 12 products here share its region, North America.

Graylog Accelerator onboarding is included.

Charging model: Graylog Open free with no volume cap; Enterprise and Security licences published by daily volume.

Graylog Open is free with no volume limit. Graylog Enterprise starts at 15,000 USD per year and Graylog Security at 18,000 USD per year, both from 10 GB per day on daily volume or from 100 GCUs on annual consumption. One GCU buys 20 GB of Security or 25 GB of Enterprise. The vendor licenses processed data in the active tier, not devices, users or stored data. Terms run from one to five years, with volume discounts built into the per-unit rate. Prices above those entry points, Cloud pricing and add-on prices are quoted by sales and are not published.

We took this from graylog.org, the vendor’s own site, when we reviewed Best SIEM Software in 2026; that review is dated 5 November 2026.

Graylog Cloud is described as a SOC 2 Type 2 certified environment with a 99.9 percent uptime SLA, authenticated and encrypted transfer, 90 days of live data and one year of archive by default. Self-managed customers choose where data lives and set retention themselves.

Graylog names EU-based OVH and Secunet SysEleven backends for tiered storage. Role-based access, SSO, LDAP and user audit logs are listed for the paid editions. Cloud hosting regions are not stated on the pages read.

Integrations the vendor names (12):

• Amazon S3
• Amazon EC2
• Amazon EKS
• AWS PrivateLink
• AWS Security Hub
• AWS Security Lake
• Qualys
• Tenable Cloud
• GitHub, GitLab and Bitbucket (Sigma repositories)
• Syslog
• GELF
• Beats and Netflow

Shared tags and a similar price model decide who is listed here; where none match, the neighbours in the ranking fill in.

• Datadog (#7 of 12): Cloud SIEM billed per gigabyte analysed, sold beside observability. (United States)
• Rapid7 InsightIDR (#8 of 12): SIEM now sold as Incident Command, in three packages. Suits: Teams wanting SIEM, endpoint detection and forensics from one vendor. (United States)
• Microsoft Sentinel (#9 of 12): Aimed at: Organisations that already run workloads in Azure and use Microsoft security tools. (United States)

Read from the vendor’s own pages on 5 November 2026.

• graylog.org/pricing: editions, starting prices, GCU, licensing FAQ, onboarding and add-ons
• graylog.org/products/security: Security features, deployment options, EU backends, AI features
• graylog.org/products/cloud: Cloud SLA, SOC 2 Type 2, retention defaults, AWS integrations

Four tests decide a position: how soon the product is useful, what the bill really becomes, how data leaves and who it suits. Here that gives Graylog the #2 position in a list of 12. Read the editorial process for the method and where paid visibility fits in.