Announcing Graylog 6.3.0-Beta.1

Graylog Downloads V6.3.0-Beta.1

Release date: 2025-05-19

• Upgrade notes
• DEB and RPM packages are available in our repositories
• Docker Compose
• Container images:
  • Graylog Open
  • Graylog Enterprise
  • Graylog Data Node
• Tarballs for manual installation:
  • Graylog Server
  • Graylog Server (bundled JVM, linux-x64)
  • Graylog Server (bundled JVM, linux-aarch64)
  • Graylog Enterprise Server
  • Graylog Enterprise Server (bundled JVM, linux-x64)
  • Graylog Enterprise Server (bundled JVM, linux-aarch64)
  • Graylog Data Node (bundled JVM, linux-x64)
  • Graylog Data Node (bundled JVM, linux-aarch64)

 

Graylog 6.3.0-beta.1

Released: 2025-05-19

Added

• Geo-IP files can now be downloaded from google-cloud-storage. graylog2-server#22191 graylog2-server#22305
• Add system notification if heap size for data node is potentially too small. graylog-plugin-enterprise#6641 graylog2-server#20168
• Added datanode sniffer to opensearch clients where applicable graylog2-server#22155
• Make elastic/opensearch hosts from rest client accessible in server. graylog2-server#22185
• Added support for Google Cloud Storage repository configuration in data node graylog2-server#22282
• Adds a permission to restrict creation of specified input types. graylog-plugin-enterprise#10477 graylog2-server#22468
• During content pack installations, entity permissions are checked before entity creation. Example: For installation of a content pack containing a stream, the user installing the content pack must have streams:create graylog-plugin-enterprise#10479 graylog2-server#22570

Changed

• Changed default AdaptiveCard schema version to 1.5 from 1.6 in Microsoft Teams Notification v2 template. graylog2-server#22571

Fixed

• Display error in message list widget when page exceeds search cluster result limit. graylog2-server#18947 graylog2-server#20644 graylog2-server#22311
• Force all requests of search job executions to be routed to the same shards for consistency. graylog2-server#22107 graylog2-server#22340
• Make deprecated pipeline rule warnings less noisy and more actionable. graylog2-server#22168 graylog2-server#22558
• Handle timestamp parsing for Netscaler WAF logs. graylog-plugin-enterprise#8844
• Fix sorting in events overview widget based on timestamp field. graylog-plugin-enterprise#8488 graylog2-server#22221
• Add permission check if a user is allowed to save searches. graylog-plugin-enterprise#10359 graylog2-server#22322
• Fixed erroneously adding fields to group_by on event replay function. graylog2-server#19862 graylog2-server#22343
• Fixed error in number of items calculation needed for paging favorites on the welcome page. graylog-plugin-enterprise#10436 graylog2-server#22397
• Add missing column names on tabular export of widgets (CSV etc.) graylog2-server#22074 graylog2-server#22426
• Revert AWS SDK to version 2.29.52 to fix compatibility with S3-compatible services. graylog-plugin-enterprise#10504 graylog2-server#22450
• Fix pipeline details page loading issue. graylog2-server#22018 graylog2-server#22455
• Alerts & Events page now filters only on the event streams that the user is allowed to see. graylog2-server#22488
• Use provided password to encrypt private key in client certificate downloads in data node graylog-plugin-enterprise#10598 graylog2-server#22518
• When inlining a global search filter, add a newly created ID graylog-plugin-enterprise#9719 graylog2-server#22531
• Fix datanode upgrade list sorting, add server version warning graylog-plugin-enterprise#10529 graylog-plugin-enterprise#10530 graylog2-server#22533
• Prevent leaking OPENSEARCH_JAVA_HOME to opensearch in data node, always use bundled JDK graylog2-server#22534
• Fix event definition creation error for users without stream read permissions. graylog2-server#20412 graylog2-server#22585

Graylog Enterprise 6.3.0-beta.1

Released: 2025-05-19

Added

• Add Google Cloud Storage support to Data Lake graylog-plugin-enterprise#10242 graylog-plugin-enterprise#10366
• Add ability to add all events from a Detection Chain as evidence to an investigation. graylog-plugin-enterprise#10288 graylog-plugin-enterprise#10441 graylog-plugin-enterprise#10569
• Added new Event Procedures. graylog-plugin-enterprise#8625 graylog-plugin-enterprise#9163 graylog-plugin-enterprise#9164 graylog-plugin-enterprise#9165 graylog-plugin-enterprise#9166 graylog-plugin-enterprise#9169 graylog-plugin-enterprise#10289 graylog-plugin-enterprise#10507 graylog-plugin-enterprise#8825 graylog-plugin-enterprise#9324 graylog-plugin-enterprise#9375 graylog2-server#21108 graylog-plugin-enterprise#9694 graylog-plugin-enterprise#10354 graylog-plugin-enterprise#10443 graylog-plugin-enterprise#10492 graylog-plugin-enterprise#10533 graylog2-server#22469 graylog2-server#22535 graylog-plugin-enterprise#10640 graylog2-server#22297 graylog2-server#22510 graylog2-server#22510 graylog2-server#22510 graylog2-server#22510 graylog2-server#22589 graylog-plugin-enterprise#10703 graylog2-server#22572 graylog-plugin-enterprise#10682 graylog2-server#22568
• Add possibility to create Google Cloud Storage Warm Tier repositories graylog-plugin-enterprise#10210 graylog-plugin-enterprise#10334 graylog-plugin-enterprise#10290
• Added built-in Admin and Reader roles for Illuminate. graylog-plugin-enterprise#10422
• Add possibility to create Google Cloud Storage archiving backend graylog-plugin-enterprise#10243 graylog-plugin-enterprise#10426
• Added new Mimecast (v2.0 API) input, and deprecated Mimecast (v1.0 API) input. graylog-plugin-enterprise#10585 graylog-plugin-enterprise#10724
• Adding the sharing button for reports. graylog-plugin-enterprise#10567 graylog-plugin-enterprise#10468 graylog-plugin-enterprise#10627
• Add SAML authentication service. graylog-plugin-enterprise#9988

Changed

• Changed permission needed to see Enterprise > Illuminate page from Admin (’*’) to illuminate_bundle_management:read. graylog-plugin-enterprise#10419

Fixed

• Fixed loss of sharing of Illuminate entities on Illuminate updates. graylog-plugin-enterprise#10161 graylog-plugin-enterprise#10658 graylog2-server#22546
• Fixed error when testing connections for existing asset sources. graylog-plugin-enterprise#10265 graylog-plugin-enterprise#10417
• Deletion of unused Data Lake backends is now working as expected. Check validation logic for Data Lake backend configuration during creation graylog-plugin-enterprise#10355 graylog-plugin-enterprise#10462
• Fixed issue when opening message details in the LogView widget where the wrong request was run for duplicated messages that came from the same input but different index sets or streams. graylog-plugin-enterprise#10357 graylog-plugin-enterprise#10361
• Fixed Overlaped text when print Threat Coverage widget. graylog-plugin-enterprise#10379 graylog-plugin-enterprise#10539
• Fixed Markdown preview displaying underneath Security Events Drawer. graylog-plugin-enterprise#10428 graylog-plugin-enterprise#10511
• Fixed issue preventing Detection Chain info from being displayed for some Security Events. graylog-plugin-enterprise#10433 graylog-plugin-enterprise#10437
• Fixed AWS S3 input restart handling and CPU utilization issues. graylog-plugin-enterprise#10496 graylog-plugin-enterprise#10499 graylog-plugin-enterprise#10534
• Improve wording for the Import Assets confirmation dialog. graylog-plugin-enterprise#10565
• Corrected permission for managing vulnerability scanners from assets:edit to asset:manage_vulnerability_scanners. graylog-plugin-enterprise#10723 graylog-plugin-enterprise#10728
• Dismissing notification closes it immediately. graylog-plugin-enterprise#8780 graylog-plugin-enterprise#10606
• Re-introduce create permission check on reports. Adding a report creator role. Allows users that are not supposed to create reports, which is a change to the previous version. graylog-plugin-enterprise#10341 graylog-plugin-enterprise#20344
• Fixed error when importing Microsoft Defender Vulnerabilities where a single machine missing a hostname would cause the vulnerability batch to fail to import. graylog-plugin-enterprise#10465
• Fixed permissions on Sigma Rules page to allow correct functionality to users with sigma_rules:edit. graylog-plugin-enterprise#10470
• Fixed empty error message on failed Microsoft Graph credential checks. graylog-plugin-enterprise#10704