Announcing Graylog Illuminate v7.2.1

Release Date: Oct 15th, 2026

In this release, we introduce new enhancements to existing content and fixes.

KNOWN ISSUES

• Illuminate: deprecation and eventual removal of some stream categories (3575)
  • Illuminate will now assign stream categories based upon the GIM Categories assigned to logs stored in the associated streams. The following stream categories are deprecated, and will be removed in Illuminate version 8.0.0: “webserver”, “firewall”, “network_traffic”, “windows_logs”, “webserver”, “linux”, “system”, “compliance”, “endpoint”, “hids”.

FIXED

• Security Core: Restored object ID values from 7.1.2 (4229)
  • Pack object ID’s were updated which breaks the continuity of customer-defined modifications to Security Core content, leading to those modifications being lost and potential errors during pack installation. This update restores the ID’s used the 7.1.2 version of Security Core, meaning customers who have not yet upgraded to 7.2.0 will have a smoother upgrade process with no lost customizations. This update also deduplicates some event procedure steps, and updates titles on event procedures with different queries but duplicated titles.
• Suricata: vendor_dcerpc_interfaces indexed as two data shapes (string and list of objects) (4198)
  • DCERPC interfaces messages from Suricata differed based upon the delivery mechanism chosen, and the fields were incorrect. The Suricata pack will now process the data in the DCERPC interfaces envelope the same, regardless of input type. The prefix “vendor_data_” for interfaces has been replaced with “vendor_” and “interface” has been corrected to “interfaces”. The DCERPC interfaces envelope will now have the “uuid” and “version” values extracted to the fields vendor_dcerpc_interfaces_uuid and vendor_dcerpc_interfaces_version. Added extraction for the interfaces property “service” and “procedure”.
• Windows/Collector – Identification field changed (4231)
• HAProxy: Parse messages from the Filebeat journald input. (4227)
  • HAProxy messages read by Filebeat from journald were identified as HAProxy but not parsed, because they do not carry the syslog header fields (such as application_name) that the parser required. They are now parsed like messages from the Syslog input.

CHANGED

• Check Point Firewall: Cleaned up vendor_user and mapped host_ip / network_tunnel_type / group_name to canonical schema fields. (3878)
  • Check Point VPN/Connectra/Identity Awareness login events now expose host_ip, network_tunnel_type (lowercased) and group_name (a list of the user’s groups) as canonical Graylog Information Model fields, and the redundant vendor_user staging field is removed once source_user_name has been populated. The Check Point host type (e.g. PC) stays in vendor_host_type.

Let us know what you’d like to have included in our GitHub issue tracker.