Collect, store, search, and analyze log data at your own pace. Start free, scale when you’re ready.
Centralized log management without compromise — faster insights, lower costs, and full visibility across your environment.
The SIEM that ends tradeoffs — complete visibility, faster threat detection, and predictable costs.
Prefer a printable version? Click here →
Graylog brings every data source into one place, with native input listeners for standard protocols and prebuilt integrations for leading SaaS, cloud, and security platforms, and centralized log collector management that simplifies deployment at scale.
| Feature | OpenSelf-Managed | EnterpriseSelf-Managed, Hybrid, Cloud | SecuritySelf-Managed, Hybrid, Cloud |
|---|---|---|---|
| Embedded MCP Server for Natural Language Tools | Included | Included | Included |
| REST API | Included | Included | Included |
| Log Collector Management | Included | Included | Included |
| Customized Data Normalization & Enrichment | Included | Included | Included |
| Input ListenersSyslog, CEF, GELF, BEATS, HTTP JSON, AWS Kinesis, IPFIX, Netflow, Plain Text | Included | Included | Included |
| SaaS/API Integrations1Password Events, AWS S3, AWS Security Lake, Azure Event Hubs, Bitdefender GravityZone, CrowdStrike, External Data Lake Filtered Input, F5 BIG-IP, GCP, Google Workspace, MS Defender for Endpoint, MS Graph, Mimecast V2, Office 365, Okta, Salesforce, Sophos Central, Symantec EDR/SES Events | Not included | Included | Included |
Graylog’s search helps analysts find what matters fast, with type-ahead query assistance, reusable filters, and parameterized searches that turn common investigations into repeatable, one-click workflows. Results come alive through visualizations, aggregations, and any search can be saved, shared with teammates, or pinned to a dashboard so insights never have to be rebuilt from scratch.
| Feature | OpenSelf-Managed | EnterpriseSelf-Managed, Hybrid, Cloud | SecuritySelf-Managed, Hybrid, Cloud |
|---|---|---|---|
| Custom Visualizations, Aggregations, Favorite Fields on Search Results | Included | Included | Included |
| Save Searches to Dashboards | Included | Included | Included |
| Type-ahead Query Assistance | Included | Included | Included |
| Save & Share Search Queries | Included | Included | Included |
| Search Filters | Not included | Included | Included |
| Saved Parameterized Searches | Not included | Included | Included |
Turn data into clear, shareable dashboards that summarize what’s happening and let you act on it right away. Scheduled reports keep leadership, auditors, and security teams informed without the manual effort.
| Feature | OpenSelf-Managed | EnterpriseSelf-Managed, Hybrid, Cloud | SecuritySelf-Managed, Hybrid, Cloud |
|---|---|---|---|
| Save & Share Dashboards | Included | Included | Included |
| Charts with Support for Markdown Text | Included | Included | Included |
| Visualization Threshold Annotations | Included | Included | Included |
| Take Action from Dashboard Charts | Limited | Included | Included |
| AI Summarization of Dashboards | Not included | Included | Included |
| Right-click Graylog + Custom Saved Searches | Not included | Included | Included |
| Scheduled Email Reports | Not included | Included | Included |
| Saved Parameterized Dashboards | Not included | Included | Included |
| Custom Compliance & Management Reports | Not included | Included | Included |
| Dashboards and Reports by Attack Surface | Not included | Not included | Included |
Define the events that matter to your environment and connect the dots across activity to surface real threats, not noise. Alerts reach your team through the tools they already use and can trigger automated responses the moment something happens.
| Feature | OpenSelf-Managed | EnterpriseSelf-Managed, Hybrid, Cloud | SecuritySelf-Managed, Hybrid, Cloud |
|---|---|---|---|
| Custom Event Creation | Limited | Included | Included |
| Alert Notification Delivery IntegrationsEmail, PagerDuty, MS Teams, Slack, HTTP | Limited | Included | Included |
| Automated Script Triggers | Not included | Included | Included |
| Correlation Engine | Not included | Included | Included |
Graylog Illuminate delivers ready-made content, from parsing and dashboards to detections, guided responses, and compliance reports, so you get value from your data from day one. Built-in enrichment adds user, device, location, and threat context automatically, giving every event the meaning it needs for faster decisions.
| Feature | OpenSelf-Managed | EnterpriseSelf-Managed, Hybrid, Cloud | SecuritySelf-Managed, Hybrid, Cloud |
|---|---|---|---|
| GeolocationAdditional subscription required | Included | Included | Included |
| Data Enrichment Connectors | Limited | Included | Included |
| Lookup Tables | Limited | Included | Included |
| Illuminate Content Hub | Limited | Included | Included |
| Input Wizard | Limited | Included | Included |
| Graylog-provided Data Normalization, Enrichment & Dashboards | Limited | Included | Included |
| Graylog-provided Reports, Detections & Saved Searches | Not included | Included | Included |
| Graylog-provided Threat Detections, Guided Responses & Compliance Reports | Not included | Not included | Included |
| Automatic User and Device Context | Not included | Not included | Included |
Alert fatigue drains lean teams before a real threat ever surfaces. Verascend turns risk-scored alerts into verified incidents through algorithms, event consolidation, and agentic workflows, tuning rules and automating evidence gathering so analysts investigate instead of filtering.
| Feature | OpenSelf-Managed | EnterpriseSelf-Managed, Hybrid, Cloud | SecuritySelf-Managed, Hybrid, Cloud |
|---|---|---|---|
| Import Sigma Rules | Not included | Not included | Included |
| MITRE ATT&CK Framework Alignment | Not included | Not included | Included |
| Event Procedures with Guided Remediation | Not included | Not included | Included |
| Third-Party SOAR and Ticketing Integration | Not included | Not included | Included |
| Detection Chain Dynamic Risk Scoring | Not included | Not included | Included |
| Threat Intel Lookups and Watchlists | Not included | Not included | Included |
| AI Investigation Report Summarization & Generation | Not included | Not included | Included |
| Embedded AI Agentic Framework with Asset Triage and Alert Fatigue Agents | Not included | Not included | Included |
| User Activity, Suspicious Data Movement, File and System Integrity, Network and Perimeter Threats | Not included | Not included | Included |
| Evidence Collection | Not included | Not included | Included |
| Investigation Timeline Visualization and Analytics | Not included | Not included | Included |
| Impossible Travel Detection & Log Volume Detectors | Not included | Not included | Included |
| Events and Alerts Risk Scoring | Not included | Not included | Included |
| Composite Risk Scoring for Users and Systems | Not included | Not included | Included |
| Threat Coverage Analyzer and Visualization | Not included | Not included | Included |
| System Vulnerability Risk Amplifier | Not included | Not included | Included |
| Variance-Based Risk Amplifier | Not included | Not included | Included |
| Threat Intelligence Detection Chain Risk Amplifier | Not included | Not included | Included |
Scale confidently with a node-based architecture, built-in health monitoring, and flexible forwarding that grows with your environment. Smart routing, data tiering, and data lake storage keep costs under control while ensuring the data you need is always within reach.
| Feature | OpenSelf-Managed | EnterpriseSelf-Managed, Hybrid, Cloud | SecuritySelf-Managed, Hybrid, Cloud |
|---|---|---|---|
| Node-Based Architecture | Included | Included | Included |
| Embedded Management for OpenSearch | Included | Included | Included |
| Graylog System Health Panel | Not included | Included | Included |
| Content Pack Import/ExportShare rules and configurations across Graylog environments | Included | Included | Included |
| Cluster MetricsGraylog Node, Graylog Data Node, MongoDB | Not included | Included | Included |
| Enterprise Forwarder | Not included | Included | Included |
| Cluster-to-Cluster Forwarder | Not included | Included | Included |
| Data Pipeline Management and Routing | Not included | Included | Included |
| Data TieringHot, Warm, Archive | Not included | Included | Included |
| Internal Data LakeAWS, GCS, Azure, SysEleven, OVH, File System | Not included | Included | Included |
| Data Lake Preview and Selective Retrieval | Not included | Included | Included |
| Filtered AWS Security Lake Input3rd-party data lake | Not included | Included | Included |
Control exactly who can see and do what, with role-based access, data separation, and seamless integration with your existing identity systems. Built-in user audit logs provide a clear record of activity to support security reviews and compliance requirements.
| Feature | OpenSelf-Managed | EnterpriseSelf-Managed, Hybrid, Cloud | SecuritySelf-Managed, Hybrid, Cloud |
|---|---|---|---|
| Role-Based Feature Access ControlAD, LDAP, or Native | Included | Included | Included |
| Logical Data Separation & Permissions | Included | Included | Included |
| AD/LDAP Group Sync | Not included | Included | Included |
| Single Sign-On | Not included | Included | Included |
| Graylog User Audit Logs | Not included | Included | Included |
| Content & Data Sharing Management | Not included | Included | Included |
Get up to speed quickly with comprehensive documentation, on-demand and instructor-led training through Graylog Academy, and an active user community. For deeper partnership, accelerator programs and dedicated Technical Account Managers help your team get the most from Graylog at every stage.
| Feature | OpenSelf-Managed | EnterpriseSelf-Managed, Hybrid, Cloud | SecuritySelf-Managed, Hybrid, Cloud |
|---|---|---|---|
| Documentation | Included | Included | Included |
| Graylog Academy On-Demand | Included | Included | Included |
| Graylog Community | Included | Included | Included |
| Graylog Academy Instructor-Led | Not included | Included | Included |
| Graylog Accelerator | Not included | Included | Included |
| Technical Account ManagerAdd-on | Not included | Optional | Optional |
