Announcing Graylog 6.3

What’s New in Graylog: Enhanced Security, and More

Release date: 2025-06-30

Graylog 6.3 introduces several enhancements aimed at improving data management, security operations, and authentication processes.

• Detection Chains as Evidence: Every detection chain is now automatically added as evidence in an investigation. That’s one less manual step and a lot more context in every case file.
• Select-All Evidence in Asset Details: Click once, collect all. The new select-all option lets you quickly gather evidence from any asset detail view — perfect when you’re triaging fast and don’t want to miss a thing.
• Event Procedures (Early Access): Introduced in Graylog 6.3, Event Procedures provide guided, in-product response actions to help standardize and streamline incident workflows. These can include steps like executing searches, sending notifications, or navigating to dashboards—all from within the Graylog interface. This feature is in early access for evaluation and feedback, and its design may evolve in future releases. To share your experience, email [email protected].
• SAML Authentication Service: A new SAML authentication service has been added, enabling organizations to integrate Graylog with their existing Single Sign-On (SSO) solutions: Integrate with Auth0, Entra ID, Keycloak, Okta, and others.
• Mimecast V2.0 Input: Support for the latest Mimecast API makes threat intake cleaner and more current.
• OIDC Improvements: You’ll now get richer user context extracted during identity and device correlation — improving detection accuracy and forensic clarity.
• Reports Sharing: Reports now have a “share” button for faster collaboration and a read-only configuration view so analysts can see what’s being reported without accidentally changing anything.
• Built-in Roles in Illuminate: Say hello to the new Admin and Reader roles in Graylog Illuminate. With easier role-based access, there will be fewer custom config headaches.

This is a release that improves Graylog’s functionality. Please read on for information on what has changed.

Release date: 2025-06-30

• Upgrade notes
• DEB and RPM packages are available in our repositories
• Docker Compose
• Container images:
  • Graylog Open
  • Graylog Enterprise
  • Graylog Data Node
• Tarballs for manual installation:
  • Graylog Server
  • Graylog Server (bundled JVM, linux-x64)
  • Graylog Server (bundled JVM, linux-aarch64)
  • Graylog Enterprise Server
  • Graylog Enterprise Server (bundled JVM, linux-x64)
  • Graylog Enterprise Server (bundled JVM, linux-aarch64)
  • Graylog Data Node (bundled JVM, linux-x64)
  • Graylog Data Node (bundled JVM, linux-aarch64)

Graylog Server Changelog

Changelog

Graylog Enterprise Changelog

Changelog

Please report bugs and any other issues in our GitHub issue tracker. Thank you!